summaryrefslogtreecommitdiffhomepage
path: root/util
AgeCommit message (Collapse)AuthorFilesLines
2025-06-16util/must: add Get2 for functions that return two valuesJames Sanderson1-0/+8
Updates #cleanup Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2025-06-16util/eventbus: remove redundant code from eventbus.PublishNick Khyl3-20/+13
eventbus.Publish() calls newPublisher(), which in turn invokes (*Client).addPublisher(). That method adds the new publisher to c.pub, so we don’t need to add it again in eventbus.Publish. Updates #cleanup Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-06-11ipn/localapi,client/local: add debug watcher for bus events (#16239)Claus Lensbøl1-0/+9
Updates: #15160 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2025-06-03posture: propagate serial number from MDM on AndroidAnton Tolchanov1-2/+2
Updates #16010 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2025-05-29util/set: add SmallSet.SoleElement, fix bug, add more testsBrad Fitzpatrick2-5/+54
This adds SmallSet.SoleElement, which I need in another repo for efficiency. I added tests, but those tests failed because Add(1) + Add(1) was promoting the first Add's sole element to a map of one item. So fix that, and add more tests. Updates tailscale/corp#29093 Change-Id: Iadd5ad08afe39721ee5449343095e389214d8389 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-29util/set: add SmallSetBrad Fitzpatrick2-0/+225
Updates tailscale/corp#29093 Change-Id: I0e07e83dee51b4915597a913b0583c99756d90e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-19cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to ↵Irbe Krumina1-8/+8
cluster Services (#15897) cmd/containerboot,kube/ingressservices: proxy VIPService TCP/UDP traffic to cluster Services This PR is part of the work to implement HA for Kubernetes Operator's network layer proxy. Adds logic to containerboot to monitor mounted ingress firewall configuration rules and update iptables/nftables rules as the config changes. Also adds new shared types for the ingress configuration. The implementation is intentionally similar to that for HA for egress proxy. Updates tailscale/tailscale#15895 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-05-12net/dns,docs/windows/policy,util/syspolicy: register Tailscale IP addresses ↵Nick Khyl2-0/+16
in AD DNS if required by policy In this PR, we make DNS registration behavior configurable via the EnableDNSRegistration policy setting. We keep the default behavior unchanged, but allow admins to either enforce DNS registration and dynamic DNS updates for the Tailscale interface, or prevent Tailscale from modifying the settings configured in the network adapter's properties or by other means. Updates #14917 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-12util/linuxfw,wgengine/router: add new netfilter rules for HA ingresses (#15896)Irbe Krumina6-39/+550
Add new rules to update DNAT rules for Kubernetes operator's HA ingress where it's expected that rules will be added/removed frequently (so we don't want to keep old rules around or rewrite existing rules unnecessarily): - allow deleting DNAT rules using metadata lookup - allow inserting DNAT rules if they don't already exist (using metadata lookup) Updates tailscale/tailscale#15895 Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
2025-05-08util/deephash: move tests that depend on other tailscale packages to ↵Nick Khyl2-156/+177
deephash_test This is done to prevent import cycles in tests. Fixes #15923 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-05-08util/eventbus: also disable websocket debug on AndroidBrad Fitzpatrick2-2/+4
So tsnet-on-Android is smaller, like iOS. Updates #12614 Updates #15297 Change-Id: I97ae997f5d17576024470fe5fea93d9f5f134bde Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07util/systemd: don't link systemd-notification package on AndroidBrad Fitzpatrick2-2/+2
Updates #12614 Change-Id: Ie5f0bb072571249f08aca09132c8491c31d01605 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-01util/linuxfw: fix delete snat rule (#15763)KevinLiang102-64/+98
* util/linuxfw: fix delete snat rule This pr is fixing the bug that in nftables mode setting snat-subnet-routes=false doesn't delete the masq rule in nat table. Updates #15661 Signed-off-by: Kevin Liang <kevinliang@tailscale.com> * change index arithmetic in test to chunk Signed-off-by: Kevin Liang <kevinliang@tailscale.com> * reuse rule creation function in rule delete Signed-off-by: Kevin Liang <kevinliang@tailscale.com> * add test for deleting the masq rule Signed-off-by: Kevin Liang <kevinliang@tailscale.com> --------- Signed-off-by: Kevin Liang <kevinliang@tailscale.com>
2025-04-25util/mak: delete long-deprecated, unused, pre-generics NonNil funcBrad Fitzpatrick2-63/+0
Updates #5590 (which deprecated it, 2.5 years ago) Change-Id: I137e82855ee33d91e5639b909f7ca64e237ed6ba Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-08all: unify some redundant testing.TB interface copiesBrad Fitzpatrick13-37/+26
I added yet another one in 6d117d64a256234 but that new one is at the best place int he dependency graph and has the best name, so let's use that one for everything possible. types/lazy can't use it for circular dependency reasons, so unexport that copy at least. Updates #cleanup Change-Id: I25db6b6a0d81dbb8e89a0a9080c7f15cbf7aa770 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-07nettest, *: add option to run HTTP tests with in-memory networkBrad Fitzpatrick1-0/+7
To avoid ephemeral port / TIME_WAIT exhaustion with high --count values, and to eventually detect leaked connections in tests. (Later the memory network will register a Cleanup on the TB to verify that everything's been shut down) Updates tailscale/corp#27636 Change-Id: Id06f1ae750d8719c5a75d871654574a8226d2733 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-06util/testenv: add func to report whether a testing.TB is in parallel modeBrad Fitzpatrick2-0/+52
For future in-memory network changes (#15558) to be able to be stricter and do automatic leak detection when it's safe to do so, in non-parallel tests. Updates tailscale/corp#27636 Change-Id: I50f03b16a3f92ce61a7ed88264b49d8c6628f638 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02ssh/tailssh: add Plan 9 support for Tailscale SSHBrad Fitzpatrick2-2/+25
Updates #5794 Change-Id: I7b05cd29ec02085cb503bbcd0beb61bf455002ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-18util/eventbus: remove debug UI from iOS buildDavid Anderson2-0/+20
The use of html/template causes reflect-based linker bloat. Longer term we have options to bring the UI back to iOS, but for now, cut it out. Updates #15297 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-13util/eventbus: add basic throughput benchmarks (#15284)M. J. Fromberger1-0/+125
Shovel small events through the pipeine as fast as possible in a few basic configurations, to establish some baseline performance numbers. Updates #15160 Change-Id: I1dcbbd1109abb7b93aa4dcb70da57f183eb0e60e Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-03-12util/eventbus: add a helper program for bus developmentDavid Anderson1-0/+103
The demo program generates a stream of made up bus events between a number of bus actors, as a way to generate some interesting activity to show on the bus debug page. Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-12util/eventbus: add a debug HTTP handler for the busDavid Anderson10-3/+541
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-07util/eventbus: add debugger methods to list pub/sub typesDavid Anderson3-0/+50
This lets debug tools list the types that clients are wielding, so that they can build a dataflow graph and other debugging views. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-07util/eventbus: don't allow publishers to skip events while debuggingDavid Anderson2-1/+5
If any debugging hook might see an event, Publisher.ShouldPublish should tell its caller to publish even if there are no ordinary subscribers. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-07util/eventbus: initial debugging facilities for the event busDavid Anderson6-66/+207
Enables monitoring events as they flow, listing bus clients, and snapshotting internal queues to troubleshoot stalls. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-06util/eventbus: add debug hooks to snoop on bus trafficDavid Anderson4-28/+56
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-06util/eventbus: add internal hook type for debuggingDavid Anderson1-0/+62
Publicly exposed debugging functions will use these hooks to observe dataflow in the bus. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-05util/eventbus: track additional event context in subscribe queueDavid Anderson2-11/+27
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-05util/eventbus: track additional event context in publish queueDavid Anderson3-10/+23
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-05util/eventbus: make internal queue a generic typeDavid Anderson3-16/+18
In preparation for making the queues carry additional event metadata. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-05util/eventbus: adjust worker goroutine management helpersDavid Anderson3-85/+104
This makes the helpers closer in behavior to cancelable contexts and taskgroup.Single, and makes the worker code use a more normal and easier to reason about context.Context for shutdown. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-03-04util/eventbus: rework to have a Client abstractionDavid Anderson6-208/+345
The Client carries both publishers and subscribers for a single actor. This makes the APIs for publish and subscribe look more similar, and this structure is a better fit for upcoming debug facilities. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-02-28util/eventbus: initial implementation of an in-process event busDavid Anderson6-0/+851
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com> Co-authored-by: M. J. Fromberger <fromberger@tailscale.com>
2025-02-27all: statically enforce json/v2 interface satisfaction (#15154)Joe Tsai4-0/+25
The json/v2 prototype is still in flux and the API can/will change. Statically enforce that types implementing the v2 methods satisfy the correct interface so that changes to the signature can be statically detected by the compiler. Updates tailscale/corp#791 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2025-02-27go.mod: bump github.com/go-json-experiment/json (#15010)Joe Tsai5-43/+43
The upstream module has seen significant work making the v1 emulation layer a high fidelity re-implementation of v1 "encoding/json". This addresses several upstream breaking changes: * MarshalJSONV2 renamed as MarshalJSONTo * UnmarshalJSONV2 renamed as UnmarshalJSONFrom * Options argument removed from MarshalJSONV2 * Options argument removed from UnmarshalJSONV2 Updates tailscale/corp#791 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2025-02-24ipn/ipnlocal,util/syspolicy,docs/windows/policy: implement the ↵Nick Khyl1-0/+7
ReconnectAfter policy setting In this PR, we update the LocalBackend so that when the ReconnectAfter policy setting is configured and a user disconnects Tailscale by setting WantRunning to false in the profile prefs, the LocalBackend will now start a timer to set WantRunning back to true once the ReconnectAfter timer expires. We also update the ADMX/ADML policy definitions to allow configuring this policy setting for Windows via Group Policy and Intune. Updates #14824 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-02-01client/tailscale,ipn/ipn{local,server},util/syspolicy: implement the ↵Nick Khyl1-1/+8
AlwaysOn.OverrideWithReason policy setting In this PR, we update client/tailscale.LocalClient to allow sending requests with an optional X-Tailscale-Reason header. We then update ipn/ipnserver.{actor,Server} to retrieve this reason, if specified, and use it to determine whether ipnauth.Disconnect is allowed when the AlwaysOn.OverrideWithReason policy setting is enabled. For now, we log the reason, along with the profile and OS username, to the backend log. Finally, we update LocalBackend to remember when a disconnect was permitted and do not reconnect automatically unless the policy changes. Updates tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-02-01util/syspolicy/internal/metrics: replace dots with underscores for metric namesNick Khyl1-0/+1
Dots are not allowed in metric names and cause panics. Since we use dots in names like AlwaysOn.OverrideWithReason, let's replace them with underscores. We don’t want to use setting.KeyPathSeparator here just yet to make it fully hierarchical, but we will decide as we progress on the (experimental) AlwaysOn.* policy settings. tailscale/corp#26146 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-31ipn/ipnauth,util/syspolicy: improve commentsNick Khyl1-0/+1
Updates #cleanup Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-31ipn/ipn{auth,server,local}: initial support for the always-on modeNick Khyl1-0/+10
In this PR, we update LocalBackend to set WantRunning=true when applying policy settings to the current profile's prefs, if the "always-on" mode is enabled. We also implement a new (*LocalBackend).EditPrefsAs() method, which is like EditPrefs but accepts an actor (e.g., a LocalAPI client's identity) that initiated the change. If WantRunning is being set to false, the new EditPrefsAs method checks whether the actor has ipnauth.Disconnect access to the profile and propagates an error if they do not. Finally, we update (*ipnserver.actor).CheckProfileAccess to allow a disconnect only if the "always-on" mode is not enabled by the AlwaysOn policy setting. This is not a comprehensive solution to the "always-on" mode across platforms, as instead of disconnecting a user could achieve the same effect by creating a new empty profile, initiating a reauth, or by deleting the profile. These are the things we should address in future PRs. Updates #14823 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-24tailcfg: adjust ServiceName.Validate to use vizerrorAdrian Dewhurst1-1/+2
Updates #cleanup Change-Id: I163b3f762b9d45c2155afe1c0a36860606833a22 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2025-01-24util/clientmetric: use counter in aggcounterKristoffer Dalby1-1/+1
Fixes #14743 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-24wgengine/filter: add check for unknown protoKristoffer Dalby1-0/+3
Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-24util/usermetric: add more drop labelsKristoffer Dalby1-0/+13
Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-23cmd/tailscaled,util/syspolicy/source,util/winutil/gp: disallow acquiring the ↵Nick Khyl2-6/+114
GP lock during service startup In v1.78, we started acquiring the GP lock when reading policy settings. This led to a deadlock during Tailscale installation via Group Policy Software Installation because the GP engine holds the write lock for the duration of policy processing, which in turn waits for the installation to complete, which in turn waits for the service to enter the running state. In this PR, we prevent the acquisition of GP locks (aka EnterCriticalPolicySection) during service startup and update the Windows Registry-based util/syspolicy/source.PlatformPolicyStore to handle this failure gracefully. The GP lock is somewhat optional; it’s safe to read policy settings without it, but acquiring the lock is recommended when reading multiple values to prevent the Group Policy engine from modifying settings mid-read and to avoid inconsistent results. Fixes #14416 Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-22util/slicesx: add AppendNonzeroBrad Fitzpatrick3-3/+25
By request of @agottardo. Updates #cleanup Change-Id: I2f02314eb9533b1581e47b66b45b6fb8ac257bb7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-17ipnlocal: allow overriding os.Hostname() via syspolicy (#14676)Andrea Gottardo1-0/+6
Updates tailscale/corp#25936 This defines a new syspolicy 'Hostname' and allows an IT administrator to override the value we normally read from os.Hostname(). This is particularly useful on Android and iOS devices, where the hostname we get from the OS is really just the device model (a platform restriction to prevent fingerprinting). If we don't implement this, all devices on the customer's side will look like `google-pixel-7a-1`, `google-pixel-7a-2`, `google-pixel-7a-3`, etc. and it is not feasible for the customer to use the API or worse the admin console to manually fix these names. Apply code review comment by @nickkhyl Signed-off-by: Andrea Gottardo <andrea@gottardo.me> Co-authored-by: Nick Khyl <1761190+nickkhyl@users.noreply.github.com>
2025-01-13all: use Go 1.21's binary.NativeEndianBrad Fitzpatrick2-8/+7
We still use josharian/native (hi @josharian!) via netlink, but I also sent https://github.com/mdlayher/netlink/pull/220 Updates #8632 Change-Id: I2eedcb7facb36ec894aee7f152c8a1f56d7fc8ba Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-12util/uniq,types/lazy,*: delete code that's now in Go stdBrad Fitzpatrick2-164/+0
sync.OnceValue and slices.Compact were both added in Go 1.21. cmp.Or was added in Go 1.22. Updates #8632 Updates #11058 Change-Id: I89ba4c404f40188e1f8a9566c8aaa049be377754 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-06ipn/ipnlocal, util/goroutines: track goroutines for tests, shutdownBrad Fitzpatrick2-1/+67
Updates #14520 Updates #14517 (in that I pulled this out of there) Change-Id: Ibc28162816e083fcadf550586c06805c76e378fc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.