summaryrefslogtreecommitdiffhomepage
path: root/tempfork
AgeCommit message (Collapse)AuthorFilesLines
2026-04-22misc/genreadme,tempfork/pkgdoc,tsnet: generate README.md files from godocfserb/mainBrad Fitzpatrick1-5/+41
Adds a CI check to keep opted-in directories' README.md files in sync with their package godoc. For now tsnet (and its sub-packages under tsnet/example) is the only opted-in tree. The list of directories lives in misc/genreadme/genreadme.go as defaultRoots, so CI and humans both just run `./tool/go run ./misc/genreadme` with no arguments. The check piggybacks on the existing go_generate job in test.yml and fails if any README.md is out of date, pointing the user at the same command. Along the way: - tempfork/pkgdoc now emits Markdown instead of plain text: headings become level-2 with no {#hdr-...} anchors, and [Symbol] doc links resolve to pkg.go.dev URLs, including for symbols in the current package (which the default Printer would otherwise emit as bare #Name fragments with no backing anchor in a README). Parsing no longer uses parser.ImportsOnly, so doc.Package knows the package's symbols and can resolve [Symbol] links at all. - genreadme also emits a pkg.go.dev Go Reference badge at the top of a library package's README; suppressed for package main. - tsnet/tsnet.go's package godoc is expanded in idiomatic godoc syntax — [Type], [Type.Method], reference-style [link]: URL definitions — rather than Markdown-flavored [text](url) or backtick-quoted identifiers, so that both pkg.go.dev and the generated README.md render cleanly from a single source. Fixes #19431 Fixes #19483 Fixes #19470 Change-Id: I8ca37e9e7b3bd446b8bfa7a91ac548f142688cb1 Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Walter Poupore <walterp@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-04-21misc/genreadme: port from corp (#19477)Walter Poupore1-0/+198
also port pkgdoc, into the tempfork folder git rev from corp at the time this copy was made: - e909fc93595414c90ff1339cece7c84500ab3c36 Updates #19470 Change-Id: I3d98d82020a2b336647b795210dcb7065dfa44d7 Change-Id: Ie63141860b76dd2d5ae3ff52f8a4bcdf6106421e Signed-off-by: Walter Poupore <walterp@tailscale.com>
2026-04-07tempfork/gliderlabs/ssh: remove tempforkKristoffer Dalby20-2809/+0
Updates #12409 Updates #5295 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-10-04feature/c2n: move answerC2N code + deps out of control/controlclientBrad Fitzpatrick1-38/+0
c2n was already a conditional feature, but it didn't have a feature/c2n directory before (rather, it was using consts + DCE). This adds it, and moves some code, which removes the httprec dependency. Also, remove some unnecessary code from our httprec fork. Updates #12614 Change-Id: I2fbe538e09794c517038e35a694a363312c426a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-04tempfork/acme: update to latest version (#15543)Andrew Lytvynov5-10/+49
Pull in https://github.com/tailscale/golang-x-crypto/pull/16 Updates #15542 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-02-19tempfork/acme: pull in latest changes for Go 1.24 (#15062)Andrew Lytvynov4-4/+38
https://github.com/tailscale/golang-x-crypto/commit/9a281fd8facad954dae80ef984c5d5d763f8ff91 Updates #15015 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-02-13ssh/tailssh: accept passwords and public keysPercy Wegmann2-1/+18
Some clients don't request 'none' authentication. Instead, they immediately supply a password or public key. This change allows them to do so, but ignores the supplied credentials and authenticates using Tailscale instead. Updates #14922 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-02-11tempfork/sshtest/ssh: add fork of golang.org/x/crypto/ssh for testing onlyBrad Fitzpatrick43-0/+19539
This fork golang.org/x/crypto/ssh (at upstream x/crypto git rev e47973b1c1) into tailscale.com/tempfork/sshtest/ssh so we can hack up the client in weird ways to simulate other SSH clients seen in the wild. Two changes were made to the files when they were copied from x/crypto: * internal/poly1305 imports were replaced by the non-internal version; no code changes otherwise. It didn't need the internal one. * all decode-with-passphrase funcs were deleted, to avoid using the internal package x/crypto/ssh/internal/bcrypt_pbkdf Then the tests passed. Updates #14969 Change-Id: Ibf1abebfe608c75fef4da0255314f65e54ce5077 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-31ssh,tempfork/gliderlabs/ssh: replace ↵Percy Wegmann12-22/+13
github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Originally implemented in 46fd4e58a27495263336b86ee961ee28d8c332b7, which was reverted in b60f6b849af1fae1cf343be98f7fb1714c9ea165 to keep the change out of v1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-29Revert "ssh,tempfork/gliderlabs/ssh: replace ↵Percy Wegmann12-13/+22
github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh" This reverts commit 46fd4e58a27495263336b86ee961ee28d8c332b7. We don't want to include this in 1.80 yet, but can add it back post 1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-28ssh,tempfork/gliderlabs/ssh: replace ↵Percy Wegmann12-22/+13
github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-27tempfork/acme: fix TestSyncedToUpstream with Windows line endingsBrad Fitzpatrick1-1/+1
Updates #10238 Change-Id: Ic85811c267679a9f79377f376d77dee3a9d92ce7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-27tempfork/acme: add new package for x/crypto package acme fork, moveBrad Fitzpatrick13-0/+5676
We've been maintaining temporary dev forks of golang.org/x/crypto/{acme,ssh} in https://github.com/tailscale/golang-x-crypto instead of using this repo's tempfork directory as we do with other packages. The reason we were doing that was because x/crypto/ssh depended on x/crypto/ssh/internal/poly1305 and I hadn't noticed there are forwarding wrappers already available in x/crypto/poly1305. It also depended internal/bcrypt_pbkdf but we don't use that so it's easy to just delete that calling code in our tempfork/ssh. Now that our SSH changes have been upstreamed, we can soon unfork from SSH. That leaves ACME remaining. This change copies our tailscale/golang-x-crypto/acme code to tempfork/acme but adds a test that our vendored copied still matches our tailscale/golang-x-crypto repo, where we can continue to do development work and rebases with upstream. A comment on the new test describes the expected workflow. While we could continue to just import & use tailscale/golang-x-crypto/acme, it seems a bit nicer to not have that entire-fork-of-x-crypto visible at all in our transitive deps and the questions that invites. Showing just a fork of an ACME client is much less scary. It does add a step to the process of hacking on the ACME client code, but we do that approximately never anyway, and the extra step is very incremental compared to the existing tedious steps. Updates #8593 Updates #10238 Change-Id: I8af4378c04c1f82e63d31bf4d16dba9f510f9199 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26control/controlclient,tempfork/httprec: don't link httptest, test certs for c2nBrad Fitzpatrick1-0/+258
The c2n handling code was using the Go httptest package's ResponseRecorder code but that's in a test package which brings in Go's test certs, etc. This forks the httptest recorder type into its own package that only has the recorder and adds a test that we don't re-introduce a dependency on httptest. Updates #12614 Change-Id: I3546f49972981e21813ece9064cc2be0b74f4b16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-17cmd/tailscale: add shell tab-completionPaul Scott13-0/+1475
The approach is lifted from cobra: `tailscale completion bash` emits a bash script for configuring the shell's autocomplete: . <( tailscale completion bash ) so that typing: tailscale st<TAB> invokes: tailscale completion __complete -- st RELNOTE=tailscale CLI now supports shell tab-completion Fixes #3793 Signed-off-by: Paul Scott <paul@tailscale.com>
2024-04-16all: use Go 1.22 range-over-intBrad Fitzpatrick1-5/+5
Updates #11058 Change-Id: I35e7ef9b90e83cac04ca93fd964ad00ed5b48430 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-03-25net/tstun: use gaissmai/bart instead of tempfork/devicePercy Wegmann6-730/+0
This implementation uses less memory than tempfork/device, which helps avoid OOM conditions in the iOS VPN extension when switching to a Tailnet with ExitNode routing enabled. Updates tailscale/corp#18514 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-03-22ipn/ipnlocal: add c2n /debug/pprof/allocs endpointPercy Wegmann3-387/+0
This behaves the same as typical debug/pprof/allocs. Updates tailscale/corp#18514 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2023-08-17all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}Brad Fitzpatrick1-0/+1
Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-07-05tempfork/heap: add copy of Go's container/heap but using genericsBrad Fitzpatrick2-0/+337
From Go commit 0a48e5cbfabd679e, then with some generics sprinkled about. Updates tailscale/corp#7354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-03-29net/tstun/table: add initial RoutingTable implementationMaisem Ali1-0/+14
It is based on `*tempfork/device.AllowedIPs`. Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-29tempfork/device: add a temp fork of golang.zx2c4.com/wireguard/deviceMaisem Ali6-0/+716
This will allow us to reuse the AllowedIPs for NAT decisions in a follow on commit. The files `allowedips_*.go` are as-is, `peer.go` only keeps the `Peer` declaration with a single element required for AllowedIPs. Upstream commit https://git.zx2c4.com/wireguard-go/commit/?id=052af4a8072bbbd3bfe7edf46fe3c1b350f71f08 Updates tailscale/corp#8020 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-11-04all: remove old +build tagsBrad Fitzpatrick5-5/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-09ssh/tailssh: add support for sending multiple bannersMaisem Ali2-8/+10
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09ssh/tailssh: do the full auth flow during ssh authMaisem Ali2-1/+22
Fixes #5091 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-09-15refactor: move from io/ioutil to io and os packagesEng Zer Jun5-10/+9
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-08-02all: gofmt for Go 1.19Brad Fitzpatrick1-12/+12
Updates #5210 Change-Id: Ib02cd5e43d0a8db60c1f09755a8ac7b140b670be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: send banner messages during auth, move more to connMaisem Ali3-7/+17
(VSCode Live Share between Brad & Maisem!) Updates #3802 Change-Id: Id8edca4481b0811debfdf56d4ccb1a46f71dd6d3 Co-Authored-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-20ssh/tailssh: terminate ssh auth early if no policy can matchMaisem Ali1-6/+0
Also bump github.com/tailscale/golang-x-crypto/ssh Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-29go.mod, ssh/tailssh, tempfork/gliderlabs: bump x/crypto/ssh fork for ↵Brad Fitzpatrick1-0/+6
NoClientAuthCallback Prep for evaluating SSHPolicy earlier to decide whether certs are required, which requires knowing the target SSH user. Updates #3802 Change-Id: I2753ec8069e7f19c9121300d0fb0813c1c627c36 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-26tempfork: temporarily fork gliderlabs/ssh and x/crypto/sshBrad Fitzpatrick20-0/+2790
While we rearrange/upstream things. gliderlabs/ssh is forked into tempfork from our prior fork at https://github.com/tailscale/ssh/commit/be8b7add4057ef5a8e458b42331a7633c06d026a x/crypto/ssh OTOH is forked at https://github.com/tailscale/golang-x-crypto because it was gnarlier to vendor with various internal packages, etc. Its git history shows where it starts (2c7772ba30643b7a2026cbea938420dce7c6384d). Updates #3802 Change-Id: I546e5cdf831cfc030a6c42557c0ad2c58766c65f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-08-26tempfork/wireguard-windows: remove the old windows firewall code now that we ↵Maisem Ali11-2745/+0
are no longer relying on it. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-08-05all: gofmt with Go 1.17Josh Bleecher Snyder7-0/+7
This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-07-19tempfork/wireguard-windows: remove unnecessary build tagJosh Bleecher Snyder1-2/+0
The _windows.go suffix suffices. This allows go:generate to run without creating a diff. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-03-01tempfork/wireguard-windows/firewall: add.David Anderson11-0/+2740
This is a fork of wireguard-windows's firewall package, with the firewall rules adjusted to better line up with tailscale's needs. The package was taken from commit 3cc76ed5f222ec82748ef3bd8c41d4b059e28cdb in our fork of wireguard-go. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-12-14go.mod: upgrade staticcheck to 0.1.0Josh Bleecher Snyder1-1/+2
Also run go.mod and fix some staticcheck warnings. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-11-18tempfork/osexec: remove old fork of os/execBrad Fitzpatrick14-1482/+0
This package was a temporary fork of os/exec to fix an EINTR loop bug that was fixed upstream for Go 1.15 in https://github.com/golang/go/commit/8c1db77a92b1d17d3fe07999c5f20602a2080be9 (https://go-review.googlesource.com/c/go/+/232862), in src/os/exec_unix.go: https://github.com/golang/go/commit/8c1db77a92b1d17d3fe07999c5f20602a2080be9#diff-72072cbd53a7240debad8aa506ff7ec795f9cfac7322e779f9bac29a4d0d0bd4
2020-11-18tempfork/registry: deleteBrad Fitzpatrick8-1493/+0
It's unused.
2020-10-02all: use testing.T.TempDirJosh Bleecher Snyder1-6/+1
Bit of Friday cleanup. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2020-07-21tempfork: add lite fork of net/http/pprof w/o html/template or reflectBrad Fitzpatrick3-0/+386
2020-06-05tempfork/registry: work around issue with Tailscale's redo build systemBrad Fitzpatrick1-0/+8
Updates tailscale/corp#293
2020-06-05tempfork/registry: add golang.org/x/sys/windows/registry + CL 236681Brad Fitzpatrick7-0/+1485
Temporary fork of golang.org/x/sys/windows/registry with: windows/registry: add Key.WaitChange wrapper around RegNotifyChangeKeyValue https://go-review.googlesource.com/c/sys/+/236681
2020-05-28tempfork/internal/testenv: removeBrad Fitzpatrick1-160/+0
It was for our x509 fork and no longer needed. (x509 changes went into our Go fork instead)
2020-04-27tempfork/x509: moved to tailscale/go's crypto/x509 insteadBrad Fitzpatrick35-18616/+0
2020-04-25tempfork/x509: remove the bundle tag in our forkBrad Fitzpatrick5-49/+0
We want to be able to omit from only one (not both)
2020-04-25tempfork/x509: store certs for iOS compressed in binary, parse lazilyBrad Fitzpatrick7-4406/+4530
2020-04-25tempfork/x509: fix build on darwin and windowsBrad Fitzpatrick3-7/+18
These fixes were originally in the updates to CL 229917 after Trybots failed there. See https://go-review.googlesource.com/c/go/+/229917/1..3
2020-04-24crypto/x509: keep smaller root cert representation in memory until neededBrad Fitzpatrick1-19/+38
(from patchset 1, c12c890c64dd6372b3893af1e6f5ab11802c9e81, of https://go-review.googlesource.com/c/go/+/230025/1, with merges fixes due to parent commit's differents from its ps1..ps3) Instead of parsing the PEM files and then storing the *Certificate values forever, still parse them to see if they're valid and pick out some fields, but then only store the decoded pem.Block.Bytes until that cert is first needed. Saves about 500K of memory on my (Debian stable) machine after doing a tls.Dial or calling x509.SystemCertPool. A more aggressive version of this is still possible: we can not keep the pem.Block.Bytes in memory either, and re-read them from disk when necessary. But dealing with files disappearing and even large multi-cert PEM files changing (with offsets sliding around) made this conservative version attractive. It doesn't change the slurp-roots-on-startup semantics. It just does so with less memory retained. Change-Id: I3aea333f4749ae3b0026042ec3ff7ac015c72204
2020-04-24crypto/x509: add support for CertPool to load certs lazilyBrad Fitzpatrick6-43/+136
(from patchset 1, 7cdc3c3e7427c9ef69e19224d6036c09c5ea1723, of https://go-review.googlesource.com/c/go/+/229917/1) This will allow building CertPools that consume less memory. (Most certs are never accessed. Different users/programs access different ones, but not many.) This CL only adds the new internal mechanism (and uses it for the old AddCert) but does not modify any existing root pool behavior. (That is, the default Unix roots are still all slurped into memory as of this CL) Change-Id: Ib3a42e4050627b5e34413c595d8ced839c7bfa14
2020-04-24Add fork of Go 1.15-dev's crypto/x509Numerous Gophers36-0/+18578
Snapshotted from Go commit 619c7a48a38b28b521591b490fd14ccb7ea5e821 (https://go-review.googlesource.com/c/go/+/229762, "crypto/x509: add x509omitbundledroots build tag to not embed roots") With 975c01342a25899962969833d8b2873dc8856a4f (https://go-review.googlesource.com/c/go/+/220721) removed, because it depends on other stuff in Go std that doesn't yet exist in a Go release. Also, add a subset fork of Go's internal/testenv, for use by x509's tests.
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.