8917 Commits

Author SHA1 Message Date
David Anderson
9d6c1a97cb derp/derphttp: remove ban on websockets dependency
The event bus's debug page uses websockets.

Updates #15160

Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-07 08:27:27 -07:00
David Anderson
9270448422 cmd/tailscaled: clean up unnecessary logf indirection #cleanup
Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
b2db198ad8 net/portmapper: fire an event when a port mapping is updated (#15371)
When an event bus is configured publish an event each time a new port mapping
is updated. Publication is unconditional and occurs prior to calling any
callback that is registered. For now, the callback is still fired in a separate
goroutine as before -- later, those callbacks should become subscriptions to
the published event.

For now, the event type is defined as a new type here in the package. We will
want to move it to a more central package when there are subscribers. The event
wrapper is effectively a subset of the data exported by the internal mapping
interface, but on a concrete struct so the bus plumbing can inspect it.

Updates #15160

Change-Id: I951f212429ac791223af8d75b6eb39a0d2a0053a
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
d13f925539 all: update the tsd.System constructor name (#15372)
Replace NewSystemWithEventBus with plain NewSystem, and update all usage.
See https://github.com/tailscale/tailscale/pull/15355#discussion_r2003910766

Updates #15160

Change-Id: I64d337f09576b41d9ad78eba301a74b9a9d6ebf4
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
20b2f8d0b8 {wgengine,util/portmapper}: add and plumb an event bus (#15359)
Updates #15160

Change-Id: I2510fb4a8905fb0abe8a8e0c5b81adb15d50a6f8
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
d01fd1ff67 portmapper: update NewClient to use a Config argument
In preparation for adding more parameters (and later, moving some away), rework
the portmapper constructor to accept its arguments on a Config struct rather
than positionally.

This is a breaking change to the function signature, but one that is very easy
to update, and a search of GitHub reveals only six instances of usage outside
clones and forks of Tailscale itself, that are not direct copies of the code
fixed up here.

While we could stub in another constructor, I think it is safe to let those
folks do the update in-place, since their usage is already affected by other
changes we can't test for anyway.

Updates #15160

Change-Id: I9f8a5e12b38885074c98894b7376039261b43f43
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
dc5f3ecdf7 wgengine: plumb an event bus into the userspace engine
Updates #15160

Change-Id: Ia695ccdddd09cd950de22abd000d4c531d6bf3c8
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
24576a9a2b tsnet: shut down the event bus on Close
Updates #15160

Change-Id: I29c8194b4b41e95848e5f160e9970db352588449
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
M. J. Fromberger
d0dbf7a206 all: construct new System values with an event bus pre-populated
Although, at the moment, we do not yet require an event bus to be present, as
we start to add more pieces we will want to ensure it is always available.  Add
a new constructor and replace existing uses of new(tsd.System) throughout.
Update generated files for import changes.

Updates #15160

Change-Id: Ie5460985571ade87b8eac8b416948c7f49f0f64b
Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-04-07 08:27:27 -07:00
David Anderson
295cde8fac tsd: wire up the event bus to tailscaled
Updates #15160

Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-07 08:27:27 -07:00
David Anderson
cae0450b7c tsweb: don't hook up pprof handlers in javascript builds
Updates #15160

Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-07 08:27:27 -07:00
Brad Fitzpatrick
6d117d64a2 util/testenv: add func to report whether a testing.TB is in parallel mode
For future in-memory network changes (#15558) to be able to be
stricter and do automatic leak detection when it's safe to do so, in
non-parallel tests.

Updates tailscale/corp#27636

Change-Id: I50f03b16a3f92ce61a7ed88264b49d8c6628f638
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-06 18:43:29 -07:00
Fran Bull
603a1d3830 cmd/natc: move address storage behind an interface
Adds IPPool and moves all IP address management concerns behind that.

Updates #14667

Signed-off-by: Fran Bull <fran@tailscale.com>
2025-04-06 14:09:37 -07:00
Andrew Lytvynov
46505ca338
tempfork/acme: update to latest version (#15543)
Pull in https://github.com/tailscale/golang-x-crypto/pull/16

Updates #15542

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-04-04 16:32:12 -07:00
Fran Bull
e2eb6eb870 cmd/natc: separate perPeerState from connector
Make the perPeerState objects able to function independently without a
shared reference to the connector.

We don't currently change the values from connector that perPeerState
uses at runtime. Explicitly copying them at perPeerState creation allows
us to, for example, put the perPeerState into a consensus algorithm in
the future.

Updates #14667

Signed-off-by: Fran Bull <fran@tailscale.com>
2025-04-04 10:46:47 -07:00
Will Norris
7b29d39f45 client/systray: add menu item to rebuild the menu
This shouldn't be necessary, but while we're continuing to figure out
the root cause, this is better than having to restart the app or switch
profiles on the command line.

Updates #15528

Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d
Signed-off-by: Will Norris <will@tailscale.com>
2025-04-03 18:02:42 -07:00
David Anderson
5e4fae0828 net/tstun: don't try to set link attributes on android
Android >= 14 forbids the use of netlink sockets.

Fixes #9836

Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-03 14:37:14 -07:00
David Anderson
7a922c3f1f net/routetable: don't try to fetch the route table on android
Android >=14 forbids the use of netlink sockets, and in some configurations
can kill apps that try.

Fixes #9836

Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-03 14:37:14 -07:00
David Anderson
66664b3167 wgengine/router: default to a fake router on android
The regular android app constructs its own wgengine with
additional FFI shims, so this default codepath only affects
other handcrafted buids like tsnet, which do not let the
caller customize the innards of wgengine.

Android >=14 forbids the use of netlink sockets, which makes
the standard linux router fail to initialize.

Fixes #9836

Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-03 14:37:14 -07:00
Jordan Whited
917bcdba79
tailcfg: add UDP relay PeerCapability's (#15516)
Updates tailscale/corp#27502

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-03 09:52:31 -07:00
dependabot[bot]
8811694745
.github: Bump actions/setup-go from 5.3.0 to 5.4.0 (#15397)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](f111f3307d...0aaccfd150)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-02 21:24:05 -06:00
Jordan Whited
66d741aa3e
tailcfg: add relay client and server NodeAttr's (#15513)
Updates tailscale/corp#27502

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-02 16:05:40 -07:00
Jordan Whited
8c062c07c6
ipn/ipnlocal: fix taildrive logf formatting verb (#15514)
Updates #cleanup

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-04-02 15:40:44 -07:00
dependabot[bot]
d18b994576
.github: Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#15400)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](4cec3d8aa0...ea165f8d65)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-02 11:59:48 -06:00
Kot
1284482790 Change README to reflect configuration
Updates #15465

Signed-off-by: Kot <kot@kot.pink>
2025-04-02 10:11:17 -07:00
Kot
c86afacf26 Move env var flag passing to Dockerfile
Updates #15465

Signed-off-by: Kot <kot@kot.pink>
2025-04-02 10:11:17 -07:00
Kot
85bcc2e3bd cmd/tsidp: use advertised env vars for config
Fixes #14491

Signed-off-by: Kot <kot@kot.pink>
2025-04-02 10:11:17 -07:00
Brad Fitzpatrick
65c7a37bc6 all: use network less when running in v86 emulator
Updates #5794

Change-Id: I1d8b005a1696835c9062545f87b7bab643cfc44d
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
29c2bb1db6 control/controlhttp: reduce some log spam on context cancel
Change-Id: I3ac00ddb29c16e9791ab2be19f454dabd721e4c3
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
4c9b37fa2e control/controlhttp: set forceNoise443 on Plan 9
Updates #5794

Change-Id: Idc67082f5d367e03540e1a5310db5b466ee03666
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
7dbb21cae8 cmd/tailscale: add tailscale.rc Plan 9 wrapper
So we can link tailscale and tailscaled together into one.

Updates #5794

Change-Id: I9a8b793c64033827e4188931546cbd64db55982e
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
84c82ac4be net/dns: add Plan 9 support
This requires the rsc/plan9 ndb DNS changes for now:

https://9fans.topicbox.com/groups/9fans/T9c9d81b5801a0820/ndb-suffix-specific-dns-changes
e8c148ff09
1d0642ae49

Updates #5794

Change-Id: I0e242c1fe7bb4404e23604e03a31f89f0d18e70d
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
5e305032a9 portlist: add Plan 9 support
Updates #5794

Change-Id: I77df1eb9bea9f079a25337cb7bbd498cf8a19135
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
b3953ce0c4 ssh/tailssh: add Plan 9 support for Tailscale SSH
Updates #5794

Change-Id: I7b05cd29ec02085cb503bbcd0beb61bf455002ac
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
6f75647c0e net/netcheck: avoid ICMP unimplemented log spam on Plan 9
Updates #5794

Change-Id: Ia6b2429d57b79770e4c278f011504f726136db5b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
03b9b879ee ipn/ipnserver: treat all plan9 safesocket connections as permitted
Updates #5794

Change-Id: Ibf74d017e38e0713d19bef437f26685280d79f6f
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
da8e8eb86f types/logger, logpolicy: disable rate limiting, don't upload on Plan 9
To ease local debugging and have fewer moving pieces while bringing up
Plan 9 support.

Updates #5794

Change-Id: I2dc98e73bbb0d4d4730dc47203efc0550a0ac0a0
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
3da1728207 cmd/tailscaled: make state dir on Plan 9
Updates #5794

Change-Id: Id7bdc08263e98a1848ffce0dd25fc034747d7393
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
21d12ec522 cmd/tailscaled: let net/netmon know what our TUN interface is
Updates #5794

Change-Id: Ia7e71c32e6c0cd79eb32b6c2c2d4e9a6d8c3e4d6
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
5df06612aa net/tsdial: tolerate empty default route on Plan 9
Otherwise this was repeated closing control/derp connections all the time
on netmon changes. Arguably we should do this on all platforms?

Updates #5794

Change-Id: If6bbeff554235f188bab2a40ab75e08dd14746b2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
7426a36371 net/netmon: disable time jump monitoring on Plan 9
Updates #5794

Change-Id: I0f96383dea2ad017988d300df723ce906debb007
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
af504fa678 safesocket: fix Plan 9 implementation
This wasn't right; it was spinning up new goroutines non-stop.
Revert to a boring localhost TCP implementation for now.

Updates #5794

Change-Id: If93caa20a12ee4e741c0c72b0d91cc0cc5870152
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
bbdd3c3bde wgengine/router: add Plan 9 implementation
Updates #5794

Change-Id: Ib78a3ea971a2374d405b024ab88658ec34be59a6
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
e3282c1632 wgengine/magicsock: avoid some log spam on Plan 9
Updates #5794

Change-Id: I12e8417ebd553f9951690c388fbe42228f8c9097
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Brad Fitzpatrick
60847128df net/tstun: add Plan 9 'tun' support
Updates #5794

Change-Id: I8c466cae25ae79be1097450a63e8c25c7b519331
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02 07:36:04 -07:00
Adrian Dewhurst
e2f7750125 tailcfg: add VIPServiceView
Not currently used in the OSS tree, a View for tailcfg.VIPService will
make implementing some server side changes easier.

Updates tailscale/corp#26272

Change-Id: If1ed0bea4eff8c4425d3845b433a1c562d99eb9e
Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
2025-04-01 20:10:48 -04:00
Brad Fitzpatrick
13f6981694 go.toolchain.rev: bump for Go 1.24.2 + plan9 fixes
Updates #5794

Change-Id: I696d49a3b0825ca90d3cb148b1c0dad9f7855808
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-01 12:23:34 -07:00
dependabot[bot]
faaa364568
.github: Bump github/codeql-action from 3.28.11 to 3.28.13 (#15477)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.11 to 3.28.13.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](6bb031afdd...1b549b9259)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-01 11:45:04 -06:00
James Tucker
95034e15a7 cmd/natc: fix ip allocation runtime
Avoid the unbounded runtime during random allocation, if random
allocation fails after a first pass at random through the provided
ranges, pick the next free address by walking through the allocated set.

The new ipx utilities provide a bitset based allocation pool, good for
small to moderate ranges of IPv4 addresses as used in natc.

Updates #15367

Signed-off-by: James Tucker <james@tailscale.com>
2025-04-01 10:23:11 -07:00
Jonathan Nobels
fb47824d74
wgengine: return explicit lo0 for loopback addrs on sandboxed macOS (#15493)
fixes tailscale/corp#27506

The source address link selection on sandboxed macOS doesn't deal
with loopback addresses correctly.  This adds an explicit check to ensure
we return the loopback interface for loopback addresses instead of the
default empty interface.

Specifically, this allows the dns resolver to route queries to a loopback
IP which is a common tactic for local DNS proxies.

Tested on both macos, macsys and tailscaled.  Forwarded requests to
127/8 all bound to lo0.

Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2025-04-01 13:20:46 -04:00