Commit Graph

7738 Commits

Author SHA1 Message Date
Maisem Ali
1cb9e33a95 cmd/k8s-operator: update env var in manifest to APISERVER_PROXY
Replace the deprecated var with the one in docs to avoid confusion.
Introduced in 335a5aaf9a.

Updates 
Fixes 

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 21:55:46 -07:00
James Tucker
c1ef55249a types/ipproto: import and test string parsing for ipproto
IPProto has been being converted to and from string formats in multiple
locations with variations in behavior. TextMarshaller and JSONMarshaller
implementations are now added, along with defined accepted and preferred
formats to centralize the logic into a single cross compatible
implementation.

Updates 
Fixes 

Signed-off-by: James Tucker <james@tailscale.com>
2023-10-11 18:56:33 -07:00
Maisem Ali
319607625f ipn/ipnlocal: fix log spam from now expected paths
These log paths were actually unexpected until the refactor in
fe95d81b43. This moves the logs
to the callsites where they are actually unexpected.

Fixes 

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 14:53:58 -07:00
Maisem Ali
9d96e05267 net/packet: split off checksum munging into different pkg
The current structure meant that we were embedding netstack in
the tailscale CLI and in the GUIs. This removes that by isolating
the checksum munging to a different pkg which is only called from
`net/tstun`.

Fixes 

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 14:25:58 -07:00
Brad Fitzpatrick
8b630c91bc wgengine/filter: use slices.Contains in another place
We keep finding these.

Updates #cleanup

Change-Id: Iabc049b0f8da07341011356f0ecd5315c33ff548
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-11 14:16:52 -07:00
James 'zofrex' Sanderson
0a412eba40
words: Na na na na na na na na na na na na na na na na ()
So gnarly!

Updates 

Signed-off-by: James Sanderson <jsanderson@tailscale.com>
2023-10-11 22:15:53 +01:00
James Tucker
11348fbe72 util/nocasemaps: import nocasemaps from corp
This is a dependency of other code being imported later.

Updates 

Signed-off-by: James Tucker <james@tailscale.com>
2023-10-11 13:55:00 -07:00
Maisem Ali
fbfee6a8c0 cmd/containerboot: use linuxfw.NetfilterRunner
This migrates containerboot to reuse the NetfilterRunner used
by tailscaled instead of manipulating iptables rule itself.
This has the added advantage of now working with nftables and
we can potentially drop the `iptables` command from the container
image in the future.

Updates 

Co-authored-by: Irbe Krumina <irbe@tailscale.com>
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 12:23:52 -07:00
Sonia Appasamy
7a0de2997e client/web: remove unused context param from NewServer
Updates 

Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-10-11 15:06:26 -04:00
Maisem Ali
aad3584319 util/linuxfw: move fake runner into pkg
This allows using the fake runner in different packages
that need to manage filter rules.

Updates #cleanup

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-11 11:48:43 -07:00
Tom DNetto
fffafc65d6 tsnet: support registering fallback TCP flow handlers
For the app connector use-case, it doesnt make sense to use listeners, because then you would
need to register thousands of listeners (for each proto/service/port combo) to handle ranges.

Instead, we plumb through the TCPHandlerForFlow abstraction, to avoid using the listeners
abstraction that would end up being a bit messy.

Signed-off-by: Tom DNetto <tom@tailscale.com>
Updates: https://github.com/tailscale/corp/issues/15038
2023-10-11 11:29:29 -07:00
David Anderson
9f05018419 clientupdate/distsign: add new prod root signing key to keychain
Updates 

Signed-off-by: David Anderson <danderson@tailscale.com>
2023-10-11 09:20:17 -07:00
Galen Guyer
04a8b8bb8e net/dns: properly detect newer debian resolvconf
Tailscale attempts to determine if resolvconf or openresolv
is in use by running `resolvconf --version`, under the assumption
this command will error when run with Debian's resolvconf. This
assumption is no longer true and leads to the wrong commands being
run on newer versions of Debian with resolvconf >= 1.90. We can
now check if the returned version string starts with "Debian resolvconf"
if the command is successful.

Fixes 

Signed-off-by: Galen Guyer <galen@galenguyer.com>
2023-10-11 08:38:25 -07:00
Paul Scott
4e083e4548
util/cmpver: only consider ascii numerals ()
Fixes 

Signed-off-by: Paul Scott <paul@tailscale.com>
2023-10-11 13:42:32 +01:00
Maisem Ali
78a083e144 types/ipproto: drop IPProto from IPProtoVersion
Based on https://github.com/golang/go/wiki/CodeReviewComments#package-names.

Updates #cleanup

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-10 23:44:48 -07:00
Maisem Ali
05a1f5bf71 util/linuxfw: move detection logic
Just a refactor to consolidate the firewall detection logic in a single
package so that it can be reused in a later commit by containerboot.

Updates 

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-10 20:29:24 -07:00
Maisem Ali
56c0a75ea9 tool/gocross: handle VERSION file not found
Fixes 

Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-10-10 17:55:33 -07:00
James Tucker
ba6ec42f6d util/linuxfw: add missing input rule to the tailscale tun
Add an explicit accept rule for input to the tun interface, as a mirror
to the explicit rule to accept output from the tun interface.

The rule matches any packet in to our tun interface and accepts it, and
the rule is positioned and prioritized such that it should be evaluated
prior to conventional ufw/iptables/nft rules.

Updates 
Fixes 
Updates 

Signed-off-by: James Tucker <james@tailscale.com>
2023-10-10 17:22:47 -07:00
Andrew Lytvynov
677d486830
clientupdate: abort if current version is newer than latest ()
This is only relevant for unstable releases and local builds. When local
version is newer than upstream, abort release.

Also, re-add missing newlines in output that were missed in
https://github.com/tailscale/tailscale/pull/9694.

Updates #cleanup

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-10-10 17:01:44 -07:00
Will Norris
7f08bddfe1 tailcfg: add type for web client auth response
This will be returned from the upcoming control endpoints for doing web
client session authentication.

Updates 

Signed-off-by: Will Norris <will@tailscale.com>
2023-10-10 15:13:50 -07:00
Flakes Updater
00977f6de9 go.mod.sri: update SRI hash for go.mod changes
Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>
2023-10-10 14:43:58 -07:00
License Updater
0ccfcb515c licenses: update tailscale{,d} licenses
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2023-10-10 14:43:50 -07:00
Brad Fitzpatrick
3749a3bbbb go.toolchain.rev: bump for CVE-2023-39325
Updates 

Change-Id: Ib001cfb44eb3e6d735dfece9bd3ae9eea13048c9
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-10 11:46:38 -07:00
Brad Fitzpatrick
6b1ed732df go.mod: bump x/net to 0.17 for CVE-2023-39325
https://go.googlesource.com/net/+/b225e7ca6dde1ef5a5ae5ce922861bda011cfabd

Updates 

Change-Id: Ia8b5e16b1acfe1b2400d321034b41370396f70e2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-10 11:25:24 -07:00
Brad Fitzpatrick
70de16bda7 ipn/localapi: make whois take IP or IP:port as documented, fix capmap netstack lookup
The whois handler was documented as taking IP (e.g. 100.101.102.103)
or IP:port (e.g. usermode 127.0.0.1:1234) but that got broken at some point
and we started requiring a port always. Fix that.

Also, found in the process of adding tests: fix the CapMap lookup in
userspace mode (it was always returning the caps of 127.0.0.1 in
userspace mode). Fix and test that too.

Updates 

Change-Id: Ie9a59744286522fa91c4b70ebe89a1e94dbded26
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-10 11:05:04 -07:00
Kristoffer Dalby
7f540042d5 ipn/ipnlocal: use syspolicy to determine collection of posture data
Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-10 12:04:34 +02:00
Kristoffer Dalby
d0b8bdf8f7 posture: add get serial support for macOS
Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-09 14:46:59 +02:00
Kristoffer Dalby
9eedf86563 posture: add get serial support for Windows/Linux
This commit adds support for getting serial numbers from SMBIOS
on Windows/Linux (and BSD) using go-smbios.

Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-09 13:50:34 +02:00
Val
249edaa349 wgengine/magicsock: add probed MTU metrics
Record the number of MTU probes sent, the total bytes sent, the number of times
we got a successful return from an MTU probe of a particular size, and the max
MTU recorded.

Updates 

Signed-off-by: Val <valerie@tailscale.com>
2023-10-09 01:57:12 -07:00
Val
893bdd729c disco,net/tstun,wgengine/magicsock: probe peer MTU
Automatically probe the path MTU to a peer when peer MTU is enabled, but do not
use the MTU information for anything yet.

Updates 

Signed-off-by: Val <valerie@tailscale.com>
2023-10-09 01:57:12 -07:00
Kristoffer Dalby
b4e587c3bd tailcfg,ipn: add c2n endpoint for posture identity
Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-09 08:15:38 +02:00
Kristoffer Dalby
9593cd3871 posture: add get serial stub for all platforms
Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-09 08:15:38 +02:00
Kristoffer Dalby
623926a25d cmd/tailscale: add --posture-checking flag to set
Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-09 08:15:38 +02:00
Kristoffer Dalby
886917c42b ipn: add PostureChecks to Prefs
Updates 

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-10-09 08:15:38 +02:00
Simon Leonhardt
553f657248 sniproxy allows configuration of hostname
Signed-off-by: Simon Leonhardt <simon@controlzee.com>
2023-10-08 15:53:52 -07:00
Brad Fitzpatrick
6f36f8842c cmd/tailscale, magicsock: add debug command to flip DERP homes
For testing netmap patchification server-side.

Updates 

Change-Id: Ib1d784bd97b8d4a31e48374b4567404aae5280cc
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-06 20:48:13 -07:00
James Tucker
13767e5108 docs/sysv: add a sysv style init script
The script depends on a sufficiently recent start-stop-daemon as to
provide the `-m` and `--remove-pidfile` flags.

Updates 

Signed-off-by: James Tucker <james@tailscale.com>
2023-10-06 19:35:58 -07:00
Brad Fitzpatrick
f991c8a61f tstest: make ResourceCheck panic on parallel tests
To find potential flakes earlier.

Updates #deflake-effort

Change-Id: I52add6111d660821c3a23d4b1dd032821344bc48
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-06 19:12:34 -07:00
James Tucker
498f7ec663 syncs: add Map.LoadOrInit for lazily initialized values
I was reviewing some code that was performing this by hand, and wanted
to suggest using syncs.Map, however as the code in question was
allocating a non-trivial structure this would be necessary to meet the
target.

Updates #cleanup

Signed-off-by: James Tucker <james@tailscale.com>
2023-10-06 17:06:11 -07:00
Joe Tsai
e4cb83b18b
taildrop: document and cleanup the package ()
Changes made:
* Unexport declarations specific to internal taildrop functionality.
* Document all exported functionality.
* Move TestRedactErr to the taildrop package.
* Rename and invert Handler.DirectFileDoFinalRename as AvoidFinalRename.

Updates 

Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2023-10-06 15:41:14 -07:00
Andrew Lytvynov
e6aa7b815d
clientupdate,cmd/tailscale/cli: use cli.Stdout/Stderr ()
In case cli.Stdout/Stderr get overriden, all CLI output should use them
instead of os.Stdout/Stderr. Update the `update` command to follow this
pattern.

Updates #cleanup

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-10-06 12:00:15 -07:00
Brad Fitzpatrick
b7988b3825 api.md: remove clientConnectivity.derp field
We don't actually send this. It's always been empty.

Updates 

Change-Id: I99b3d7a355fca17d2159bf81ede5be4ddd4b9dc9
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-06 09:29:42 -07:00
Rhea Ghosh
557ddced6c
{ipn/ipnlocal, taildrop}: move put logic to taildrop ()
Cleaning up taildrop logic for sending files.

Updates 

Signed-off-by: Rhea Ghosh <rhea@tailscale.com>
Co-authored-by: Joe Tsai <joetsai@digital-static.net>
2023-10-06 09:47:03 -05:00
David Anderson
c761d102ea tool/gocross: don't absorb --tags flags passed to subcommand
Fixes 

Signed-off-by: David Anderson <danderson@tailscale.com>
2023-10-05 17:11:03 -07:00
Andrew Lytvynov
559f560d2d
go.toolchain.rev: bump go to 1.21.2 ()
Updates https://github.com/tailscale/go/pull/75

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-10-05 17:04:07 -07:00
Joe Tsai
c42398b5b7
ipn/ipnlocal: cleanup incomingFile ()
This is being moved to taildrop, so clean it up to stop depending
on so much unreleated functionality by removing a dependency
on peerAPIHandler.

Updates 

Signed-off-by: Joe Tsai <joetsai@digital-static.net>
Co-authored-by: Rhea Ghosh <rhea@tailscale.com>
2023-10-05 16:26:06 -07:00
Andrew Lytvynov
3ee756757b
cmd/tailscale/cli: add update notification to "up" ()
Add available update message in "tailscale up" output. Also update the
message in "tailscale status" to match and mention auto-update.

Updates https://github.com/tailscale/tailscale/issues/755

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2023-10-05 16:21:06 -07:00
Rhea Ghosh
dc1c7cbe3e
taildrop: initial commit of taildrop functionality refactoring ()
Over time all taildrop functionality will be contained in the
taildrop package. This will include end to end unit tests. This is
simply the first smallest piece to move over.

There is no functionality change in this commit.

Updates 

Signed-off-by: Rhea Ghosh <rhea@tailscale.com>
Co-authored-by: Joseph Tsai <joetsai@tailscale.com>
2023-10-05 16:05:45 -07:00
Sonia Appasamy
3befc0ef02 client/web: restrict full management client behind browser sessions
Adds `getTailscaleBrowserSession` to pull the user's session out of
api requests, and `serveTailscaleAuth` to provide the "/api/auth"
endpoint for browser to request auth status and new sessions.

Updates 

Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-10-05 17:21:39 -04:00
Brad Fitzpatrick
7868393200 net/dns/resolver, ipnlocal: fix ExitDNS on Android and iOS
Advertise it on Android (it looks like it already works once advertised).

And both advertise & likely fix it on iOS. Yet untested.

Updates 

Change-Id: If3b7e97f011dea61e7e75aff23dcc178b6cf9123
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-10-05 12:55:07 -07:00