summaryrefslogtreecommitdiffhomepage
path: root/tsnet
AgeCommit message (Collapse)AuthorFilesLines
2025-09-02util/syspolicy: finish plumbing policyclient, add feature/syspolicy, move ↵Brad Fitzpatrick1-1/+2
global impl This is step 4 of making syspolicy a build-time feature. This adds a policyclient.Get() accessor to return the correct implementation to use: either the real one, or the no-op one. (A third type, a static one for testing, also exists, so in general a policyclient.Client should be plumbed around and not always fetched via policyclient.Get whenever possible, especially if tests need to use alternate syspolicy) Updates #16998 Updates #12614 Change-Id: Iaf19670744a596d5918acfa744f5db4564272978 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02util/syspolicy/{setting,ptype}: move PreferenceOption and Visibility to new ↵Brad Fitzpatrick1-0/+1
leaf package Step 3 in the series. See earlier cc532efc2000 and d05e6dc09e. This step moves some types into a new leaf "ptype" package out of the big "settings" package. The policyclient.Client will later get new methods to return those things (as well as Duration and Uint64, which weren't done at the time of the earlier prototype). Updates #16998 Updates #12614 Change-Id: I4d72d8079de3b5351ed602eaa72863372bd474a2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-01util/syspolicy/policyclient: add policyclient.Client interface, start plumbingBrad Fitzpatrick1-2/+3
This is step 2 of ~4, breaking up #14720 into reviewable chunks, with the aim to make syspolicy be a build-time configurable feature. Step 1 was #16984. In this second step, the util/syspolicy/policyclient package is added with the policyclient.Client interface. This is the interface that's always present (regardless of build tags), and is what code around the tree uses to ask syspolicy/MDM questions. There are two implementations of policyclient.Client for now: 1) NoPolicyClient, which only returns default values. 2) the unexported, temporary 'globalSyspolicy', which is implemented in terms of the global functions we wish to later eliminate. This then starts to plumb around the policyclient.Client to most callers. Future changes will plumb it more. When the last of the global func callers are gone, then we can unexport the global functions and make a proper policyclient.Client type and constructor in the syspolicy package, removing the globalSyspolicy impl out of tsd. The final change will sprinkle build tags in a few more places and lock it in with dependency tests to make sure the dependencies don't later creep back in. Updates #16998 Updates #12614 Change-Id: Ib2c93d15c15c1f2b981464099177cd492d50391c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-31util/syspolicy/*: move syspolicy keys to new const leaf "pkey" packageBrad Fitzpatrick1-0/+1
This is step 1 of ~3, breaking up #14720 into reviewable chunks, with the aim to make syspolicy be a build-time configurable feature. In this first (very noisy) step, all the syspolicy string key constants move to a new constant-only (code-free) package. This will make future steps more reviewable, without this movement noise. There are no code or behavior changes here. The future steps of this series can be seen in #14720: removing global funcs from syspolicy resolution and using an interface that's plumbed around instead. Then adding build tags. Updates #12614 Change-Id: If73bf2c28b9c9b1a408fe868b0b6a25b03eeabd1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-28wgengine/magicsock: shorten process internal DERP queueJames Tucker1-1/+0
DERP writes go via TCP and the host OS will have plenty of buffer space. We've observed in the wild with a backed up TCP socket kernel side buffers of >2.4MB. The DERP internal queue being larger causes an increase in the probability that the contents of the backbuffer are "dead letters" - packets that were assumed to be lost. A first step to improvement is to size this queue only large enough to avoid some of the initial connect stall problem, but not large enough that it is contributing in a substantial way to buffer bloat / dead-letter retention. Updates tailscale/corp#31762 Signed-off-by: James Tucker <james@tailscale.com>
2025-08-28util/ringbuffer: rename to ringlogJames Tucker1-1/+1
I need a ringbuffer in the more traditional sense, one that has a notion of item removal as well as tail loss on overrun. This implementation is really a clearable log window, and is used as such where it is used. Updates #cleanup Updates tailscale/corp#31762 Signed-off-by: James Tucker <james@tailscale.com>
2025-08-26go.toolchain.branch: bump to go1.25 (#16954)Patrick O'Doherty1-2/+13
go.toolchain.rev: bump go1.25 version flake.nix: bump Go to 1.25 Updates #16330 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2025-08-23ipn,tsnet: update AdvertiseTags documentation (#16931)M. J. Fromberger1-5/+4
Instead of referring to groups, which is a term of art for a different entity, update the doc comments to more accurately describe what tags are in reference to the policy document. Updates #cleanup Change-Id: Iefff6f84981985f834bae7c6a6c34044f53f2ea2 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-08-23tsnet: add Server.AdvertiseTags option (#15840)Mohammed Naser1-0/+8
Updates #8531 Change-Id: I9b6653872c66929e692bd592ef3f438430c657b5 Signed-off-by: Valentin Alekseev <valentin.alekseev@gmail.com> Co-authored-by: Valentin Alekseev <valentin.alekseev@gmail.com>
2025-08-21wgengine/magicsock,net/sockopts: export Windows ICMP suppression logic (#16917)Jordan Whited1-1/+1
For eventual use by net/udprelay.Server. Updates tailscale/corp#31506 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-08-20net/sockopts,wgengine/magicsock: export socket buffer sizing logic (#16909)Jordan Whited1-0/+1
For eventual use by net/udprelay.Server Updates tailscale/corp#31164 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-08-18ipn/localapi: plumb an event bus through the localapi.Handler (#16892)M. J. Fromberger1-2/+14
Some of the operations of the local API need an event bus to correctly instantiate other components (notably including the portmapper). This commit adds that, and as the parameter list is starting to get a bit long and hard to read, I took the opportunity to move the arguments to a config type. Only a few call sites needed to be updated and this API is not intended for general use, so I did not bother to stage the change. Updates #15160 Updates #16842 Change-Id: I7b057d71161bd859f5acb96e2f878a34c85be0ef Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-08-13net/{batching,packet},wgengine/magicsock: export batchingConn (#16848)Jordan Whited1-0/+1
For eventual use by net/udprelay.Server. Updates tailscale/corp#31164 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-31cmd/tsidp,tsnet: update tsidp oidc-key store path (#16735)Mike O'Driscoll1-0/+6
The tsidp oidc-key.json ended up in the root directory or home dir of the user process running it. Update this to store it in a known location respecting the TS_STATE_DIR and flagDir options. Fixes #16734 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-07-29ipn,net,tsnet,wgengine: make an eventbus mandatory where it is used (#16594)M. J. Fromberger1-4/+1
In the components where an event bus is already plumbed through, remove the exceptions that allow it to be omitted, and update all the tests that relied on those workarounds execute properly. This change applies only to the places where we're already using the bus; it does not enforce the existence of a bus in other components (yet), Updates #15160 Change-Id: Iebb92243caba82b5eb420c49fc3e089a77454f65 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-06-10cmd/tailscale/cli: add a risk message about rp_filterAnton Tolchanov1-1/+1
We already present a health warning about this, but it is easy to miss on a server when blackholing traffic makes it unreachable. In addition to a health warning, present a risk message when exit node is enabled. Example: ``` $ tailscale up --exit-node=lizard The following issues on your machine will likely make usage of exit nodes impossible: - interface "ens4" has strict reverse-path filtering enabled - interface "tailscale0" has strict reverse-path filtering enabled Please set rp_filter=2 instead of rp_filter=1; see https://github.com/tailscale/tailscale/issues/3310 To skip this warning, use --accept-risk=linux-strict-rp-filter $ ``` Updates #3310 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-05-29go.mod: bump golang.org/x depsBrad Fitzpatrick1-1/+2
Updates #8043 Change-Id: I8702a17130559353ccdecbe8b64eeee461ff09c3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-28tsnet: remove an expired configuration-path migration step (#16120)M. J. Fromberger1-47/+1
As note in the comment, it now being more than six months since this was deprecated and there being no (further) uses of the old pattern in our internal services, let's drop the migrator. Updates #cleanup Change-Id: Ie4fb9518b2ca04a9b361e09c51cbbacf1e2633a8 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-05-22client/web: add Sec-Fetch-Site CSRF protection (#16046)Patrick O'Doherty1-6/+3
RELNOTE=Fix CSRF errors in the client Web UI Replace gorilla/csrf with a Sec-Fetch-Site based CSRF protection middleware that falls back to comparing the Host & Origin headers if no SFS value is passed by the client. Add an -origin override to the web CLI that allows callers to specify the origin at which the web UI will be available if it is hosted behind a reverse proxy or within another application via CGI. Updates #14872 Updates #15065 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2025-05-19cmd/derper, net/tlsdial: fix client's self-signed cert validationBrad Fitzpatrick1-0/+1
This fixes the implementation and test from #15208 which apparently never worked. Ignore the metacert when counting the number of expected certs presented. And fix the test, pulling out the TLSConfig setup code into something shared between the real cmd/derper and the test. Fixes #15579 Change-Id: I90526e38e59f89b480629b415f00587b107de10a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-09wgengine/magicsock: re-shape relayManager to use an event loop (#15935)Jordan Whited1-0/+1
The event loop removes the need for growing locking complexities and synchronization. Now we simply use channels. The event loop only runs while there is active work to do. relayManager remains no-op inside magicsock for the time being. endpoints are never 'relayCapable' and therefore endpoint & Conn will not feed CallMeMaybeVia or allocation events into it. A number of relayManager events remain unimplemented, e.g. CallMeMaybeVia reception and relay handshaking. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-09ipn/ipnlocal,net/dns/resolver: use the user dialer and routes for DNS ↵Nick Khyl1-1/+1
forwarding by default, except on iOS and Android In this PR, we make the "user-dial-routes" behavior default on all platforms except for iOS and Android. It can be disabled by setting the TS_DNS_FORWARD_USE_ROUTES envknob to 0 or false. Updates #12027 Updates #13837 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-08feature/taildrop, ipn/ipnlocal: remove leftover dup calls to osshareBrad Fitzpatrick1-1/+0
I'd moved the osshare calls to feature/taildrop hooks, but forgot to remove them from ipnlocal, or lost them during a rebase. But then I noticed cmd/tailscaled also had some, so turn those into a hook. Updates #12614 Change-Id: I024fb1d27fbcc49c013158882ee5982c2737037d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-08util/eventbus: also disable websocket debug on AndroidBrad Fitzpatrick1-7/+7
So tsnet-on-Android is smaller, like iOS. Updates #12614 Updates #15297 Change-Id: I97ae997f5d17576024470fe5fea93d9f5f134bde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-08tsnet: add test for packet filter generation from netmapJames Sanderson1-0/+248
This is an integration test that covers all the code in Direct, Auto, and LocalBackend that processes NetMaps and creates a Filter. The test uses tsnet as a convenient proxy for setting up all the client pieces correctly, but is not actually a test specific to tsnet. Updates tailscale/corp#20514 Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-05-07all: remove non-applicable "linux" deps on AndroidBrad Fitzpatrick1-8/+8
Updates #12614 Change-Id: I0e2a18eca3515d3d6206c059110556d2bbbb0c5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07util/systemd: don't link systemd-notification package on AndroidBrad Fitzpatrick1-1/+1
Updates #12614 Change-Id: Ie5f0bb072571249f08aca09132c8491c31d01605 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07net/dns: don't link dbus, gonotify on AndroidBrad Fitzpatrick1-3/+3
Android is Linux, but doesn't use Linux DNS managers (or D-Bus). Updates #12614 Change-Id: I487802ac74a259cd5d2480ac26f7faa17ca8d1c3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07ipn/store: don't link in AWS & Kubernetes stuff on AndroidBrad Fitzpatrick1-80/+80
Android is Linux, but that not much Linux. Updates #12614 Change-Id: Ice80bd3e3d173511c30d05a43d25a31e18928db7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07tsnet: add android & iOS results to depawareBrad Fitzpatrick1-119/+119
Updates #12614 Change-Id: Icd21deb754e7073871eeb34edadd41c167ec5984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07tsnet: don't depend on condregister & its default tailscaled featuresBrad Fitzpatrick2-47/+16
None of them are applicable to the common tsnet use cases. If somebody wants one of them, they can empty import it. Updates #12614 Change-Id: I3d7f74b555eed22e05a09ad667e4572a5bc452d8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07Makefile: add tsnet to depawareBrad Fitzpatrick1-0/+680
Updates #12614 Change-Id: Iff30bc457efcc96f60b563195b213cbc4dccc349 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-30tsnet: add FunnelTLSConfig FunnelOption typeBrad Fitzpatrick1-11/+43
And also validate opts for unknown types, before other side effects. Fixes #15833 Change-Id: I4cabe16c49c5b7566dcafbec59f2cd1e0c8b4b3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-16net/netmon: publish events to event busDavid Anderson1-1/+1
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-16all: update the tsd.System constructor name (#15372)M. J. Fromberger1-1/+1
Replace NewSystemWithEventBus with plain NewSystem, and update all usage. See https://github.com/tailscale/tailscale/pull/15355#discussion_r2003910766 Updates #15160 Change-Id: I64d337f09576b41d9ad78eba301a74b9a9d6ebf4 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16tsnet: shut down the event bus on CloseM. J. Fromberger1-1/+4
Updates #15160 Change-Id: I29c8194b4b41e95848e5f160e9970db352588449 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-16all: construct new System values with an event bus pre-populatedM. J. Fromberger1-1/+2
Although, at the moment, we do not yet require an event bus to be present, as we start to add more pieces we will want to ensure it is always available. Add a new constructor and replace existing uses of new(tsd.System) throughout. Update generated files for import changes. Updates #15160 Change-Id: Ie5460985571ade87b8eac8b416948c7f49f0f64b Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-03-25tsnet: Default executable name on iOSJames Nugent1-0/+5
When compiled into TailscaleKit.framework (via the libtailscale repository), os.Executable() returns an error instead of the name of the executable. This commit adds another branch to the switch statement that enumerates platforms which behave in this manner, and defaults to "tsnet" in the same manner as those other platforms. Fixes #15410. Signed-off-by: James Nugent <james@jen20.com>
2025-03-21tsnet: use test logger for testcontrol and node logsJames Sanderson1-1/+2
Updates #cleanup Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-03-11tsnet,wgengine: fix src to primary Tailscale IP for TCP dialsFran Bull1-2/+7
Ensure that the src address for a connection is one of the primary addresses assigned by Tailscale. Not, for example, a virtual IP address. Updates #14667 Signed-off-by: Fran Bull <fran@tailscale.com>
2025-02-18tsnet: require I_Acknowledge_This_API_Is_Experimental to use ↵Percy Wegmann1-0/+9
AuthenticatedAPITransport() It's not entirely clear whether this capability will be maintained, or in what form, so this serves as a warning to that effect. Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-02-18tsnet: provide AuthenticatedAPITransport for use with ↵Percy Wegmann1-2/+27
tailscale.com/client/tailscale/v2 This allows use of the officially supported control server API, authenticated with the tsnet node's nodekey. Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-02-18cmd,tsnet,internal/client: create internal shim to deprecated control plane APIPercy Wegmann1-0/+3
Even after we remove the deprecated API, we will want to maintain a minimal API for internal use, in order to avoid importing the external tailscale.com/client/tailscale/v2 package. This shim exposes only the necessary parts of the deprecated API for internal use, which gains us the following: 1. It removes deprecation warnings for internal use of the API. 2. It gives us an inventory of which parts we will want to keep for internal use. Updates tailscale/corp#22748 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-02-05all: use new LocalAPI client package locationBrad Fitzpatrick2-9/+10
It was moved in f57fa3cbc30e. Updates tailscale/corp#22748 Change-Id: I19f965e6bded1d4c919310aa5b864f2de0cd6220 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-04ipn/{ipnserver,localapi},tsnet: use ipnauth.Self as the actor in tsnet ↵Nick Khyl1-2/+3
localapi handlers With #14843 merged, (*localapi.Handler).servePrefs() now requires a non-nil actor, and other places may soon require it as well. In this PR, we update localapi.NewHandler with a new required parameter for the actor. We then update tsnet to use ipnauth.Self. We also rearrange the code in (*ipnserver.Server).serveHTTP() to pass the actor via Handler's constructor instead of the field. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-28tsnet: return from Accept when the listener gets closedAnton Tolchanov2-3/+35
Fixes #14808 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-01-22feature/*: make Wake-on-LAN conditional, start supporting modular featuresBrad Fitzpatrick1-0/+1
This pulls out the Wake-on-LAN (WoL) code out into its own package (feature/wakeonlan) that registers itself with various new hooks around tailscaled. Then a new build tag (ts_omit_wakeonlan) causes the package to not even be linked in the binary. Ohter new packages include: * feature: to just record which features are loaded. Future: dependencies between features. * feature/condregister: the package with all the build tags that tailscaled, tsnet, and the Tailscale Xcode project extension can empty (underscore) import to load features as a function of the defined build tags. Future commits will move of our "ts_omit_foo" build tags into this style. Updates #12614 Change-Id: I9c5378dafb1113b62b816aabef02714db3fc9c4a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-21tsnet: block in Server.Dial until backend is RunningBrad Fitzpatrick2-0/+72
Updates #14715 Change-Id: I8c91e94fd1c6278c7f94a6b890274ed8a01e6f25 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-21tsnet: fix panic on race between listener.Close and incoming packetBrad Fitzpatrick2-11/+33
I saw this panic while writing a new test for #14715: panic: send on closed channel goroutine 826 [running]: tailscale.com/tsnet.(*listener).handle(0x1400031a500, {0x1035fbb00, 0x14000b82300}) /Users/bradfitz/src/tailscale.com/tsnet/tsnet.go:1317 +0xac tailscale.com/wgengine/netstack.(*Impl).acceptTCP(0x14000204700, 0x14000882100) /Users/bradfitz/src/tailscale.com/wgengine/netstack/netstack.go:1320 +0x6dc created by gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*Forwarder).HandlePacket in goroutine 807 /Users/bradfitz/go/pkg/mod/gvisor.dev/gvisor@v0.0.0-20240722211153-64c016c92987/pkg/tcpip/transport/tcp/forwarder.go:98 +0x32c FAIL tailscale.com/tsnet 0.927s Updates #14715 Change-Id: I9924e0a6c2b801d46ee44eb8eeea0da2f9ea17c4 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-16Switch logging service from log.tailscale.io to log.tailscale.com (#14398)Joe Tsai1-1/+1
Updates tailscale/corp#23617 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.