summaryrefslogtreecommitdiffhomepage
path: root/net/tshttpproxy
AgeCommit message (Collapse)AuthorFilesLines
2026-01-23all: remove AUTHORS file and references to itWill Norris7-7/+7
This file was never truly necessary and has never actually been used in the history of Tailscale's open source releases. A Brief History of AUTHORS files --- The AUTHORS file was a pattern developed at Google, originally for Chromium, then adopted by Go and a bunch of other projects. The problem was that Chromium originally had a copyright line only recognizing Google as the copyright holder. Because Google (and most open source projects) do not require copyright assignemnt for contributions, each contributor maintains their copyright. Some large corporate contributors then tried to add their own name to the copyright line in the LICENSE file or in file headers. This quickly becomes unwieldy, and puts a tremendous burden on anyone building on top of Chromium, since the license requires that they keep all copyright lines intact. The compromise was to create an AUTHORS file that would list all of the copyright holders. The LICENSE file and source file headers would then include that list by reference, listing the copyright holder as "The Chromium Authors". This also become cumbersome to simply keep the file up to date with a high rate of new contributors. Plus it's not always obvious who the copyright holder is. Sometimes it is the individual making the contribution, but many times it may be their employer. There is no way for the proejct maintainer to know. Eventually, Google changed their policy to no longer recommend trying to keep the AUTHORS file up to date proactively, and instead to only add to it when requested: https://opensource.google/docs/releasing/authors. They are also clear that: > Adding contributors to the AUTHORS file is entirely within the > project's discretion and has no implications for copyright ownership. It was primarily added to appease a small number of large contributors that insisted that they be recognized as copyright holders (which was entirely their right to do). But it's not truly necessary, and not even the most accurate way of identifying contributors and/or copyright holders. In practice, we've never added anyone to our AUTHORS file. It only lists Tailscale, so it's not really serving any purpose. It also causes confusion because Tailscalars put the "Tailscale Inc & AUTHORS" header in other open source repos which don't actually have an AUTHORS file, so it's ambiguous what that means. Instead, we just acknowledge that the contributors to Tailscale (whoever they are) are copyright holders for their individual contributions. We also have the benefit of using the DCO (developercertificate.org) which provides some additional certification of their right to make the contribution. The source file changes were purely mechanical with: git ls-files | xargs sed -i -e 's/\(Tailscale Inc &\) AUTHORS/\1 contributors/g' Updates #cleanup Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d Signed-off-by: Will Norris <will@tailscale.com>
2025-11-17go.mod: bump golang.org/x/crypto (#17907)Andrew Lytvynov1-4/+4
Pick up a fix for https://pkg.go.dev/vuln/GO-2025-4116 (even though we're not affected). Updates #cleanup Change-Id: I9f2571b17c1f14db58ece8a5a34785805217d9dd Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-09-30feature, net/tshttpproxy: pull out support for using proxies as a featureBrad Fitzpatrick1-1/+2
Saves 139 KB. Also Synology support, which I saw had its own large-ish proxy parsing support on Linux, but support for proxies without Synology proxy support is reasonable, so I pulled that out as its own thing. Updates #12614 Change-Id: I22de285a3def7be77fdcf23e2bec7c83c9655593 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-15net/tshttpproxy: use errors.New for error creation (#16860)Will Hannah1-1/+2
Updates tailscale/corp#30668 Signed-off-by: Will Hannah <willh@tailscale.com>
2025-08-14net/tshttpproxy: add macOS support for system proxy (#16826)Will Hannah1-0/+17
Adds a setter for proxyFunc to allow macOS to pull defined system proxies. Disallows overriding if proxyFunc is set via config. Updates tailscale/corp#30668 Signed-off-by: Will Hannah <willh@tailscale.com>
2025-05-29net/tshttpproxy: fix WDAP/PAC proxy detection on Win10 1607 and earlierNick Khyl1-8/+20
Using WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG on Windows versions older than Windows 10 1703 (build 15063) is not supported and causes WinHttpGetProxyForUrl to fail with ERROR_INVALID_PARAMETER. This results in failures reaching the control on environments where a proxy is required. We use wingoes version detection to conditionally set the WINHTTP_AUTOPROXY_ALLOW_AUTOCONFIG flag on Windows builds greater than 15063. While there, we also update proxy detection to use WINHTTP_AUTO_DETECT_TYPE_DNS_A, as DNS-based proxy discovery might be required with Active Directory and in certain other environments. Updates tailscale/corp#29168 Fixes #879 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-07all: fix golangci-lint errorsWill Norris2-2/+2
These erroneously blocked a recent PR, which I fixed by simply re-running CI. But we might as well fix them anyway. These are mostly `printf` to `print` and a couple of `!=` to `!Equal()` Updates #cleanup Signed-off-by: Will Norris <will@tailscale.com>
2024-11-05types/result, util/lineiter: add package for a result type, use itBrad Fitzpatrick1-7/+8
This adds a new generic result type (motivated by golang/go#70084) to try it out, and uses it in the new lineutil package (replacing the old lineread package), changing that package to return iterators: sometimes over []byte (when the input is all in memory), but sometimes iterators over results of []byte, if errors might happen at runtime. Updates #12912 Updates golang/go#70084 Change-Id: Iacdc1070e661b5fb163907b1e8b07ac7d51d3f83 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-16all: use Go 1.22 range-over-intBrad Fitzpatrick1-1/+1
Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-02-22net/tshttpproxy: log when we're using a proxyAndrew Dunham1-1/+25
Updates #11196 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id6334c10f52f4cfbda9f03dc8096ab7a6c54a088
2023-03-29net/tshttpproxy: don't proxy through ourselvesAndrew Dunham2-2/+200
When running a SOCKS or HTTP proxy, configure the tshttpproxy package to drop those addresses from any HTTP_PROXY or HTTPS_PROXY environment variables. Fixes #7407 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I6cd7cad7a609c639780484bad521c7514841764b
2023-03-04all: use tstest.Replace moreMaisem Ali1-7/+5
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-02-03net/tshttpproxy: more directly use Transport proxy CONNECT hooksMihai Parparita2-51/+24
GetProxyConnectHeader (golang/go#41048) was upstreamed in Go 1.16 and OnProxyConnectResponse (golang/go#54299) in Go 1.20, thus we no longer need to guard their use by the tailscale_go build tag. Updates #7123 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris8-24/+16
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2022-11-14net/tshttpproxy: don't ignore env-based HTTP proxies after system lookups failBrad Fitzpatrick2-5/+40
There was a mechanism in tshttpproxy to note that a Windows proxy lookup failed and to stop hitting it so often. But that turns out to fire a lot (no PAC file configured at all results in a proxy lookup), so after the first proxy lookup, we were enabling the "omg something's wrong, stop looking up proxies" bit for awhile, which was then also preventing the normal Go environment-based proxy lookups from working. This at least fixes environment-based proxies. Plenty of other Windows-specific proxy work remains (using WinHttpGetIEProxyConfigForCurrentUser instead of just PAC files, ignoring certain types of errors, etc), but this should fix the regression reported in #4811. Updates #4811 Change-Id: I665e1891897d58e290163bda5ca51a22a017c5f9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-04all: remove old +build tagsBrad Fitzpatrick4-4/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-03net/tshttpproxy: add clientmetrics on Windows proxy lookup pathsBrad Fitzpatrick1-0/+16
To collect some data on how widespread this is and whether there's any correlation between different versions of Windows, etc. Updates #4811 Change-Id: I003041d0d7e61d2482acd8155c1a4ed413a2c5c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-29all: fix spelling mistakesJosh Soref2-2/+2
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
2022-09-15refactor: move from io/ioutil to io and os packagesEng Zer Jun1-3/+2
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-08-04all: use syncs.AtomicValueMaisem Ali1-3/+3
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-07-27net/tshttpproxy: fix incorrect type in Windows implementation, switch to ↵Aaron Klotz3-44/+133
mkwinsyscall, fix memory leak The definition of winHTTPProxyInfo was using the wrong type (uint16 vs uint32) for its first field. I fixed that type. Furthermore, any UTF16 strings returned in that structure must be explicitly freed. I added code to do this. Finally, since this is the second time I've seen type safety errors in this code, I switched the native API calls over to use wrappers generated by mkwinsyscall. I know that would not have helped prevent the previous two problems, but every bit helps IMHO. Updates https://github.com/tailscale/tailscale/issues/4811 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2022-04-28net/tshttpproxy: synology: pick proxy by schemeJames Tucker2-72/+175
This updates the fix from #4562 to pick the proxy based on the request scheme. Updates #4395, #2605, #4562 Signed-off-by: James Tucker <james@tailscale.com>
2022-04-28net/tshttpproxy: use http as the scheme for proxiesMaisem Ali2-7/+7
Currently we try to use `https://` when we see `https_host`, however that doesn't work and results in errors like `Received error: fetch control key: Get "https://controlplane.tailscale.com/key?v=32": proxyconnect tcp: tls: first record does not look like a TLS handshake` This indiciates that we are trying to do a HTTPS request to a HTTP server. Googling suggests that the standard is to use `http` regardless of `https` or `http` proxy Updates #4395, #2605 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-26net/tshttpproxy: fix typoBrad Fitzpatrick1-1/+1
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-21tshttpproxy: support synology proxy configurationJames Tucker3-0/+446
Fixes #4395 Fixes #2605 Signed-off-by: James Tucker <james@tailscale.com>
2022-03-18net/tshttpproxy: ensure we pass the correct flags to WinHttpOpen on Win7 and ↵Aaron Klotz1-1/+26
Win8.0 The best flag to use on Win7 and Win8.0 is deprecated in Win8.1, so we resolve the flag depending on OS version info. Fixes https://github.com/tailscale/tailscale/issues/4201 Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2021-11-22net/tshttpproxy: use correct size for Windows BOOL argumentJosh Bleecher Snyder1-1/+1
The Windows BOOL type is an int32. We were using a bool, which is a one byte wide. This could be responsible for the ERROR_INVALID_PARAMETER errors we were seeing for calls to WinHttpGetProxyForUrl. We manually checked all other existing Windows syscalls for similar mistakes and did not find any. Updates #879 Co-authored-by: Aaron Klotz <aaron@tailscale.com> Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-08-05all: gofmt with Go 1.17Josh Bleecher Snyder1-0/+1
This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-03-03net/tshttpproxy: call winhttp calls from a fixed OS threadBrad Fitzpatrick1-0/+4
We often see things in logs like: 2021-03-02 17:52:45.2456258 +0800 +0800: winhttp: Open: The parameter is incorrect. 2021-03-02 17:52:45.2506261 +0800 +0800: tshttpproxy: winhttp: GetProxyForURL("https://log.tailscale.io/c/tailnode.log.tailscale.io/5037bb42f4bc330e2d6143e191a7ff7e837c6be538139231de69a439536e0d68"): ERROR_INVALID_PARAMETER [unexpected] I have a hunch that WinHTTP has thread-local state. If so, this would fix it. If not, this is pretty harmless. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-18net/tshttpproxy: support HTTP proxy environment credentials on Windows tooBrad Fitzpatrick2-16/+18
and some minor style nits. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-17net/tshttpproxy: support basic auth when available (#1354)Christine Dodrill2-0/+61
This allows proxy URLs such as: http://azurediamond:hunter2@192.168.122.154:38274 to be used in order to dial out to control, logs or derp servers. Signed-off-by: Christine Dodrill <xe@tailscale.com>
2020-11-03net/tshttpproxy: aggressively rate-limit error logs in Transport.Proxy pathBrad Fitzpatrick1-3/+18
Otherwise log upload HTTP requests generate proxy errrors which generate logs which generate HTTP requests which generate proxy errors which generate more logs, etc. Fixes #879
2020-09-21net/tshttpproxy: appease staticcheckBrad Fitzpatrick1-0/+2
2020-09-21net/tshttpproxy: add GetProxyForURL negative cacheBrad Fitzpatrick2-1/+38
Otherwise when PAC server is down, we log, and each log entry is a new HTTP request (from logtail) and a new GetProxyForURL call, which again logs, non-stop. This is also nicer to the WinHTTP service. Then also hook up link change notifications to the cache to reset it if there's a chance the network might work sooner.
2020-09-02net/tshttpproxy: fix typo in Windows code added at least secondBrad Fitzpatrick1-1/+1
I ran tests & vet & staticcheck, but for Linux, not Windows. (#728 would be nice)
2020-09-02net/tshttpproxy: if winhttp.GetProxyForURL blocks too long, use previous valueBrad Fitzpatrick1-26/+66
We currently have a chickend-and-egg situation in some environments where we can set up routes that WinHTTP's WPAD/PAC resolution service needs to download the PAC file to evaluate GetProxyForURL, but the PAC file is behind a route for which we need to call GetProxyForURL to e.g. dial a DERP server. As a short-term fix, just assume that the most recently returned proxy is good enough for such situations.
2020-08-28net/tshttpproxy: add more winhttp loggingBrad Fitzpatrick1-1/+7
Notably around duration of calls.
2020-08-28tshttp, derphttp: send Proxy-Authorization, not Authorization, to proxiesBrad Fitzpatrick1-1/+13
Whoops. But weirdly, sending Authorization sometimes worked?
2020-08-27net/tshttpproxy: move the TS_DEBUG_FAKE_PROXY_AUTH knob up a levelBrad Fitzpatrick2-4/+4
2020-08-26tshttpproxy, controlclient, derphttp, logpolicy: send Negotiate auth to proxiesBrad Fitzpatrick2-0/+50
For Windows only, and only when built with Tailscale's Go tree. Updates tailscale/corp#583
2020-08-25net/tshttpproxy: add start of Kerberos Negotiate auth to proxies on WindowsBrad Fitzpatrick2-0/+31
For now only used by a new cmd/tailscale debug --get-url subcommand. Not yet wired up to the places making HTTP requests. Updates tailscale/corp#583
2020-08-24net/tshttpproxy: discard secondary Windows proxies for nowBrad Fitzpatrick1-0/+4
2020-08-18net/tshttpproxy: new package, support WPAD/PAC proxies on WindowsBrad Fitzpatrick2-0/+175
Updates tailscale/corp#553 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.