Repository navigation
feat(ci): Bump to upstream v1.102.5 - #36
Closed
ChandonPierre wants to merge 498 commits into
Closed
ChandonPierre wants to merge 498 commits into
ChandonPierre wants to merge 498 commits into
Conversation
I'm not keen on us having to deal with the bad side effects of the autocrlf default, but alas, if it makes things easier. Fixes tailscale#16175 Closes tailscale#16176 Signed-off-by: James Tucker <james@tailscale.com>
…ression Otherwise we may never handshake a new peer relay server endpoint around remote client restarts and/or disco key rotation. Updates tailscale#20215 Signed-off-by: Jordan Whited <jordan@tailscale.com>
Another baby step toward removing slices of peers from the engine. getStatus iterated peerSequence (a key snapshot built in Reconfig from cfg.Peers) and then asked wgdev for each peer's stats; peers that weren't active in wgdev silently fell out. Iterate active wgdev peers directly via RemoveMatchingPeers(returnFalse) instead. Updates tailscale#12542 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I3abd348abc30db706db29b3a785179259e48abda
userspaceEngine.PeerForIP read from e.netMap.Peers and e.lastCfgFull.Peers, both of which go stale when peers arrive via netmap deltas (which skip Engine.SetNetworkMap and Engine.Reconfig). Every PeerForIP caller (Engine.Ping, the TSMP disco-key handler, pendopen diagnostics, tsdial.Dialer.UseNetstackForIP, and LocalBackend.GetPeerEndpointChanges) would report "no matching peer" for freshly-added peers. Fix it the same way SetPeerByIPPacketFunc fixed the outbound packet hot path: have LocalBackend install a callback that reads the live nodeBackend. nb.NodeByAddr is built from both SelfNode and Peers (updateNodeByAddrLocked), so a single lookup covers the common case with IsSelf set when the matched node ID is SelfNode's. The subnet- route / exit-node-default-route slow path goes through a new Engine.PeerKeyForIP that exposes the engine's AllowedIPs BART table (the same table the outbound packet hot path already consults, with exit-node selection honored), and resolves the matched key back to a NodeView via the live nodeBackend. Updates tailscale#12542 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I0d4b0d8997c8e796b7367c46b49b61d4fdc717b0
…scale#20237) The logging added in 12188c0 was generating excessive spam in backend logs. This may have been exacerbated by tailscale GUI<->backend architecture on certain platforms like Windows, where the GUI polls for exit node suggestions rather than listening on the IPN bus. Change this to log on error or if the current suggestion differs from the previous suggestion. Updates tailscale/corp#43691 Updates tailscale#20194 Signed-off-by: Amal Bansode <amal@tailscale.com>
Most of our flag descriptions start with a lowercase word (except proper nouns); fix the handful which do not. Fixes tailscale#20230 Change-Id: I00aaac171254c050ad0b75c2cf8746590c8c4d8f Signed-off-by: Alex Chan <alexc@tailscale.com>
Add a retry loop with BatchMode=yes to absorb the race window between Env.Start() returning (when tta reports the tailscale backend as Running) and cloud-init finishing the user/SSH-key setup. In CI, the second VM's tta agent has been observed connecting only a few hundred milliseconds before the test SSHes in, which is inside the window where /root/.ssh/authorized_keys hasn't fully landed yet. SSH key auth then fails and ssh(1) falls back to interactive password prompts (3x), wasting time and producing a confusing "Permission denied (publickey,password)" error. BatchMode=yes makes the client fail fast on auth failure instead of prompting, and the retry loop handles SSH transport-level errors (exit code 255) for up to 30 seconds with 500ms backoff. Remote command non-zero exits still pass through unchanged. Fixes tailscale#20228 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I17f7422e9e27bf7b995f505c0184cbb2b230ed81
Env.Start boots all VM nodes in parallel; each calls createCloudInitISO -> ensureDebugSSHKey concurrently. When /tmp/vmtest_key doesn't yet exist, the first goroutine creates it with os.WriteFile, which opens with O_CREATE|O_TRUNC and briefly leaves the file existing-but-empty between the open and the subsequent write. A concurrent goroutine that hits that window sees ReadFile succeed with zero bytes, then fails ssh.ParsePrivateKey with "ssh: no key found", causing boot to fail with: boot: creating cloud-init ISO: parse /tmp/vmtest_key: ssh: no key found Observed in CI on TestSiteToSite (3 nodes). Wrap the function in a package-level Mutex so the first caller fully writes the key before any other caller reads it. Updates tailscale#20228 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: Ie6399dcba0c397bb8041931d3de1c6063a11c568
tsdial.Dialer.SetNetMap rebuilt an O(n peers) map of MagicDNS names on every netmap change. As we move toward per-peer incremental deltas, this becomes quadratic. This removes it and replaces it with SetResolveMagicDNS, a callback into LocalBackend that looks up hostnames from nodeBackend's new nodeByName index (populated alongside nodeByAddr/nodeByKey on both full and delta paths). The index stores both FQDNs and short names as keys. This is the same treatment applied to netlog (8f21045), wglog (988b090), and drive (1d69894): stop pushing *netmap.NetworkMap into subsystems and instead have them pull from LocalBackend's live data via callbacks. Updates tailscale#12542 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I24557ab0c8a27636e08e4779bcfd3ec633db0a78
Add zizmor GitHub Actions linting on changes to .github/workflows. Updates tailscale/corp#28760 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
…ailscale#20199) Router.Set reconciled tailscale0's addresses only against the in-memory r.addrs map, which starts empty each run. After a restart the kernel can still hold the addresses a previous profile put on tailscale0. With no record of them, Set never removed them, leaving two tailnets' CGNAT addresses on the interface. That broke connectivity, because the kernel could source traffic from the wrong IP. Fix this by scanning the addresses actually on the interface and, after reconciling the desired set, removing any in Tailscale's CGNAT/ULA ranges that aren't in the config. Non-Tailscale addresses are never touched, and IPv6 addresses are skipped when IPv6 is unavailable, since delAddress no-ops there. To avoid a netlink dump on every Set, the scan runs only on the first Set and when the desired address set changes. This also needs the iptables DelLoopbackRule to tolerate a missing rule: an orphan left by a previous instance never went through AddLoopbackRule here, and iptables (unlike nftables) errors when deleting an absent rule, which would otherwise block the address delete. Fixes tailscale#19974 Signed-off-by: Brendan Creane <bcreane@gmail.com>
The primary purpose is that return packets from the target app get properly SNATed on connectors with --tun=userspace-networking, matching the NAT behavior in the kernel tun path. This is also necessary but not sufficient for clients of connectors in userspace networking mode. The hook will DNAT MagicIPs, but won't actually be sent MagicIPs until conn25 app connector DNS works with userspace networking. Fixes tailscale/corp#43201 Signed-off-by: Michael Ben-Ami <mzb@tailscale.com>
The engine only used the netmap to look up self addresses and the self node's primary routes, so pass it the self node directly rather than the whole netmap. Updates tailscale#12542 Change-Id: I13c0028eed65d2177baf4cf6c449f5e441845a18 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
setWebClientAtomicBoolLocked and setDebugLogsByCapabilityLocked each only need the node capabilities to decide what to do, so take a set.Set[tailcfg.NodeCapability] directly as part of getting rid of netmap.NetworkMap. Updates tailscale#12542 Change-Id: If7c30b6354fd42dfe82ed6d2e2fe3439de401315 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
No code changes needed; this is to rule out cmpver as the source of any version-comparison issues. Updates tailscale#20238 Change-Id: Ib8765dd042e994549d9e2c03859a5f769a856704 Signed-off-by: Alex Chan <alexc@tailscale.com>
364b952 switched containerboot to partial netmap fetching, but stopped refreshing `DNS.ExtraRecords`, so Tailscale Services created after pod boot were invisible to resolveTailnetFQDN. To fix we watch for SelfChange ipn bus notifies, and refetch dns-config via LocalAPI to get a fresh set of `DNS.ExtraRecords`. Fixes tailscale#20233 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
… receive extensions" (tailscale#20257) * Revert "control/controlclient: continue map poll during key expiry to receive extensions" This reverts commit 6a822dc. This commit has caused test failures in the corp repo by unexpected changing the login behaviour when nodes have a valid node key. Updates tailscale/corp#43705 Updates tailscale#19326 Signed-off-by: Alex Chan <alexc@tailscale.com> * Revert "tsnet: test key extension after server restart" This reverts commit 3172013. This test relies on changes in 3172013, which is also being reverted because it causes test failures in corp. Updates tailscale/corp#43705 Updates tailscale#19326 Signed-off-by: Alex Chan <alexc@tailscale.com> --------- Signed-off-by: Alex Chan <alexc@tailscale.com>
…ailscale#20169) This patch adds a new `client-side-reachability-routecheck` node attribute to allow admins to selectively enable background routecheck probing on trial nodes. The current implementation is still experimental. It adds the routecheck.IsEnabled helper to check for the new `client-side-reachability-routecheck` node attribute alongside the existing `client-side-reachability` node attribute in this node’s self capabilities. This allows administrators to turn on and off this feature by editing the policy file. It adds the `TS_DEBUG_FORCE_CLIENT_SIDE_REACHABILITY_ROUTECHECK` environment variable which can be set to override the policy file. When set to `true`, it forcibly enables this feature. And when set to `false`, it forcibly disables it. Updates tailscale#17366 Updates tailscale/corp#33033 Signed-off-by: Simon Law <sfllaw@tailscale.com>
Occasionally CI jobs will flake because downloading from GitHub fails. Allow retrying up to 3 times to reduce CI flakiness. Updates #cleanup Change-Id: Ib019e89ac74b81d78f71a40099b20ff60014a81f Signed-off-by: Alex Chan <alexc@tailscale.com>
…err (tailscale#19968) On optimistic lock error, requeue the event after a short duration. Resolves a case where a failure to acquire an optimistic lock on the dnsrecords configmap will cause the operator to drop a reconcile event and leave the configmap in an undesirable state. Updates tailscale#19946 Signed-off-by: Alex Freestone <freestone.alex@gmail.com>
updates tailscale/corp#44019 WebClient is very useful for remote management on tvOS (which cannot do ssh). Let's include it there. Minimal corresponding tailscale/corp changes to follow to add UI to set the required prefs. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
We stopped reading this field nearly two years ago, with a TODO comment to remove it sometime in 2025. It is now 2026. Updates tailscale#12058 Change-Id: I8ddf1c2e4c3c428e8d45a6491d3899368ec52c30 Signed-off-by: Alex Chan <alexc@tailscale.com>
…nsion
The ACME serialization mutex (acmeMu) was a package-level global, and
several ACME-related fields lived on LocalBackend even though the
cert code is conditional and not linked into every binary. With
multiple tsnet.Servers in one process (each its own LocalBackend),
a process-wide acmeMu also serialized unrelated backends.
Introduce a new feature/acme extension that owns the per-LocalBackend
ACME/cert state in an ipnlocal.CertState value:
- acmeMu, renewMu, renewCertAt (previously package globals)
- pendingACMETLSALPNCerts, pendingCertDomains{,Mu},
getCertForTest, certRefreshCancel (previously LocalBackend
fields, only meaningful when ACME was compiled in)
ipnlocal/cert.go now reaches the state through b.certState(), which
is routed by a feature.Hook installed at init by feature/acme. The
CertState type lives in ipnlocal so cert.go can access its fields
directly without a method explosion; the extension in feature/acme
constructs and owns it.
This is a baby step. The end goal is for the entire cert/ACME code
to live in feature/acme, with ipnlocal only retaining whatever thin
hooks the rest of LocalBackend needs to call into it. The current
split (CertState and most of cert.go in ipnlocal, extension wrapper
in feature/acme) is a deliberately temporary middle ground that
keeps this PR small while making the next moves mechanical.
The package is named feature/acme to match the existing HasACME /
ts_omit_acme naming. condregister/maybe_acme.go wires it in for
non-js builds.
Updates tailscale#12614
Updates tailscale#20248
Updates tailscale#20249
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I520909f24ad11a9622ef33c2290fe36ad44d6f71
GitHub's built-in CODEOWNERS only supports a hard "block until a team member reviews" rule, with no way to leave an audit trail when the requirement is intentionally bypassed. Move review enforcement to palantir/policy-bot (https://github.com/palantir/policy-bot) running at https://policybot.corp.ts.net, which lets us express the same tailcfg/ -> control-protocol-owners rule plus an explicit override: any other @tailscale/dev member can post policybot-override: <reason> as a PR comment and that comment counts as their approval, with the reason recorded in the PR conversation as a permanent audit trail. CODEOWNERS is kept as a one-screen comment so anyone landing on it expecting the old behavior is directed to .policy.yml. Updates tailscale/corp#13972 Change-Id: I2dc3619c498d4c4a6decae29aa123f6d67905eed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
The override comment didn't work as expected. (I'll be updating the policytest package to handle this) Updates tailscale/corp#13972 Change-Id: Ic5c16eed09c8cb5fa8dab37d43cf05f8dfa75d49 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
prometheus/common v0.66/v0.67 introduced a mandatory model.ValidationScheme on expfmt.TextParser as part of prepping for UTF-8 metric/label names in Prometheus 3.0. The zero value is intentionally UnsetValidation, which panics on the first call to IsValidMetricName / IsValidLabelName with Invalid name validation scheme requested: unset so the long-standing "var parser expfmt.TextParser" pattern crashes at runtime. Several big downstreams have hit the same sharp edge: thanos-io/thanos#8823 grafana/loki#21401 Switch our two callers (parseMetrics in tsnet's TestUserMetricsByteCounters and the client-metrics scraper in tstest/natlab/vmtest) to the new expfmt.NewTextParser constructor with model.LegacyValidation. LegacyValidation matches the classic ASCII metric/label naming rules that tailscaled's exporter uses today; if and when we ever emit a metric with a UTF-8 name, we can revisit. Goes to v0.69.0 (the latest at the time of writing) rather than v0.67.5 so we pick up the unrelated security fixes for cross-host redirects. Done in advance so a follow-up change can pull in github.com/tailscale/policybottest (which depends on palantir/policy-bot, which transitively requires prometheus/common at v0.67+) without dragging this debugging into that PR. Updates tailscale/corp#13972 Change-Id: I4b37db9ad3bebef1a32d9020bf6f8790bab25336 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Add a .policy-tests.yml file with tests exercising the policy that was just landed: the tailcfg/ control-protocol-owners gate, the "policybot-override:" comment escape hatch (including defaults-regression guards so the override rule does not silently accept a normal review or a 👍 comment), and the always-on "any tailscale/dev review" baseline. Updates tailscale/corp#13972 Change-Id: I42afb06b0771658c803512cb5de4701450c8a704 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
WhoIs lookups for an IPv6-mapped IPv4 address such as "::ffff:100.87.98.86" failed to match the node's canonical IPv4 address. Unmap the address before looking it up so these resolve. Fixes tailscale#20235 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Bouke van der Bijl <i@bou.ke>
Move all the FooForTest methods on LocalBackend to instead be methods on a new unexported forTest type which is then given out to callers in other packages via an exported ForTest method (panicking in non-test contexts) that returns that unexported type. This is unusual style (exported returning unexported) but declutters godoc and makes call sites both more explicit and easier to read without the "ForTest" suffix polluting the symbols. Now FooForTest() changes into ForTest().Foo(). This was motivated by a pending change moving a bunch of code out of LocalBackend into other packages that required adding more ForTest methods to LocalBackend to keep the tests (now in other packages) working. Instead, do this refactor now so the future change is prettier. Updates tailscale#12614 Updates #cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: Ib25e6d76d48dc8622ac3a955e0b1220d582e63a8
…ailscale#20834) (tailscale#20837) This commit changes how PeerRelay services are exposed on AWS. A Network Load Balancer only forwards to targets in an availability zone enabled on it, and spec.aws.elasticIPs pins each service to a single subnet, which enables just one zone. A replica scheduled anywhere else silently receives nothing while still reporting PeerRelayReady with an address in status.endpoints. Without spec.aws we now leave the subnet unpinned, so the AWS Load Balancer Controller spreads the load balancer over every zone it finds, and cross-zone load balancing is on by default so any of its addresses reach the pod. Hostname resolution is no longer gated on the eip-allocations annotation, which had left these unpinned services in EndpointsPending forever, and a failure to resolve now logs at debug since it is expected while a load balancer provisions. Such a load balancer has an address per zone, and AWS bills for each, so every one of them is now advertised rather than only the lowest sorted. That also lets a peer reach the relay when one zone is unreachable. status.endpoints gains address as a second list map key so a replica can hold an entry per address; no field changes, so existing readers of endpoints[].address keep working. Readiness counts the replicas that have an endpoint rather than the entries, so a replica with several addresses cannot mask one that has none. The pods now serve containerboot's health check endpoint and the load balancer is pointed at it over HTTP. A peer relay listens only on UDP, so the default TCP check against the port the load balancer forwards could never succeed and every target sat unhealthy while relaying perfectly well. /healthz reports 200 once the device has tailnet addresses, which is the condition that actually matters. The CRD docs now describe spec.aws as the exception, note that it also needs a ProxyClass pinning pods to the zone of the subnets it names, and drop the claim that an Elastic IP has an availability zone of its own. Conflicts were resolved in peerrelay.go and statefulset.go, which on this branch predate the loginServer config field and the multi-tailnet auth key rework. The surrounding release branch code is kept as-is and only the endpoint slice is taken from the original commit. Fixes: tailscale#20833 (cherry picked from commit 7f45894) Signed-off-by: David Bond <davidsbond93@gmail.com>
We previously identified sync failures that occur when a node falls behind the remote, and compacts away most its local state. We fixed the underlying issue in tailscale#19444, but that PR only tested the basic scenario where the local chain is a direct ancestor of the remote chain. This patch adds an explicit regression test for the case where a node is on a fork (that is, its HEAD is not part of the remote's active chain). Although tailscale#19444 happened to cover this case, other proposed patches did not handle the forked state. Adding this test locks in the behaviour and prevents future sync regressions in this area. Also, add a shared helper for writing this sort of TKA sync test. Updates tailscale/corp#40404 Change-Id: I78fdc6beaf71392edf11806197f126db48886f93 Signed-off-by: Alex Chan <alexc@tailscale.com> (cherry picked from commit b5fb042)
I wrote this function two hours ago, tried to use it in corp, and immediately found myself confused about the meaning of the arguments. Time for named parameters! Updates tailscale/corp#40404 Change-Id: Ic2866e052ccc9f6361b8d529233df54d63abbaa1 Signed-off-by: Alex Chan <alexc@tailscale.com> (cherry picked from commit aec6f8b)
Since tailscale#17567, FS.ChildAUMs scans and decodes every active AUM file. Authority reconstruction and compaction call it repeatedly, making filesystem work quadratic in the number of AUMs. Build per-FS indexes of active AUM hashes and parent-to-child relationships in one scan. Use the indexes for graph queries while continuing to decode returned AUM values from disk. Invalidate the indexes after mutations, but retain them for empty purges. A production-sized 825-AUM benchmark improves from 124 seconds to 4 seconds on macOS with Defender and from 5.9 seconds to 34 milliseconds on Linux ext3. The checked-in benchmark exercises the 2,000-AUM maximum linear history accepted by the traversal guardrail. RELNOTE: Avoid Tailnet Lock startup failures with large authority histories. Fixes tailscale#20735 Change-Id: I088136bc2e9d1b6bfdecb223c069d42400c9f63d Signed-off-by: Michael Renner <terrorobe@github.com> (cherry picked from commit ea9b1a2)
I cherry-picked these changes to get the SeedAUMs helper for another cherry-picked commit, but this branch is missing the fix. Remove the tests for now; the required fix isn't currently in consideration for this release. Updates tailscale/corp#40404 Change-Id: Ic8991f3ee41140e9553bf0ad73c3d114f8947c15 Signed-off-by: Alex Chan <alexc@tailscale.com>
…ctually enabled on interface We stop waiting to see if registry keys come available; this causes bad interactions with the LocalBackend watchdog. Instead we check the network interface for availability of AF_INET, AF_INET6, and AF_NETBIOS. If no IP families are available on the interface, we fail with an error. Otherwise we only attempt to configure DNS for the address families that are actually enabled. We also avoid changing any NetBIOS settings if AF_NETBIOS is disabled. Fixes tailscale/corp#46276 (cherry picked from commit 4bf9382) Signed-off-by: Aaron Klotz <aaron@tailscale.com>
Updates #cleanup (cherry picked from commit 4782f36) Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
Currently we serialise ACME account setup and ACME issuances for domains which don't yet have a valid certificate, but not for async renewals of still-valid certificates. This patch adds a check that we only have one async renewal for a domain in-flight at a time, and a test that ensures we de-dupe these renewals. Updates tailscale/corp#46420 Change-Id: Ibbaa537cd28b8adf238b5c9396403e845f95b7e7 Signed-off-by: Alex Chan <alexc@tailscale.com> (cherry picked from commit 2d98e75)
…ailscale#20914) containerboot waits up to 60s for the initial map response before failing. Slow map responses (>60s seen in production) leaves containerboot to timeout and fail. Add a TS_BOOT_TIMEOUT env var to override the default. Falls back to 60s when unset. Fixes tailscale#20912 (cherry picked from commit 86c1787) Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
…cale#20866) (tailscale#20926) The packet filter only sees a via address's outer ULA, so netstack unconditionally dialed whatever IPv4 was embedded in it. This change refuses TCP, UDP, and ping relays to host-scoped destinations after UnmapVia. Credit to the Anthropic infrastructure security team for finding and reporting. Fixes tailscale/corp#46646 Change-Id: I93d8e27a2eddbce7eb3f8c5fa4677f8de3a8ed9e Change-Id: I8865c0e89474600b0b8254ebebd0523e29412e58 (cherry picked from commit 90ed0bc) Signed-off-by: Mike Jensen <mikej@tailscale.com>
Signed-off-by: Nick O'Neill <nick@tailscale.com>
Our tests are inconsistent in how they set environment variables and cleanup. Missing cleanup logic can leak environment variable state across tests and change the behaviour of subsequent tests. This recently caused flakes in feature/acme, where `TestGetCertPEMWithValidity` leaked `TS_CERT_SHARE_MODE` and `TestAsyncRenewalDedup` to fail inconsistently. To fix the immediate flake and prevent future leaks, introduce a `SetenvForTest` helper that handles setting and cleaning up environment variables in tests. Fixes tailscale#20902 Change-Id: I9f8ef45ec875d66034cfd0054311bd69b67e2243 Signed-off-by: Alex Chan <alexc@tailscale.com> (cherry picked from commit 468241a)
* ipn/ipnlocal: fix cache update for peers deleted by netmap deltas (tailscale#20851) After a netmap delta is applied, we scan the mutations for affected peers and update the cache (if enabled) for those peers. For removals in particular, we were relying on the node backend to resolve node IDs (provided by the delta mutation) to stable IDs. Prior to 65fd320 this happened to work because the node backend would hold on to all the peers mentioned by the previous full netmap, even after applying deltas. But that was essentially accidental, and once we fixed it not to do that, these lookups no longer worked. We need the stable ID, since that is how the cache is keyed, and now that they're no longer pinned, we were not properly evicting removed peers from the cache. To fix this, capture removed peer stable IDs while applying mutations to the node backend, instead of trying to look them up afterward. Updates tailscale#20796 Change-Id: I14ded78eaf9657645f0869a52460fd3cd86edba6 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com> (cherry picked from commit f3552c2) * ipn/ipnlocal: don't evict another node's index entries on netmap deltas When applying netmap deltas, nodeBackend evicted its index entries (nodeByAddr, nodeByKey, nodeByWGString, nodeByStableID, nodeByName) derived from a node's last-known value without checking that the entry still pointed at that node. Control can reassign a churning ephemeral peer's Tailscale IP (or MagicDNS name) to a newer peer and deliver the new peer's upsert before the old peer's removal, either in an earlier MapResponse or reordered within one batch by the NodeID sort in netmap.MutationsFromMapResponse. The removal then wiped the new owner's entry. The peers map itself stayed correct in every ordering, so WireGuard kept the peer and handshakes succeeded, but WhoIs lookups by IP failed until the next full netmap rebuilt the indexes. On App Connectors that surfaced as "peerapi: unknown peer" and refused DNS connections from affected clients, with a toggle of Tailscale (forcing a full netmap) as the only recovery. Make every index eviction conditional on the entry still mapping to the node being removed or replaced, and add a regression test covering the cross-batch, intra-batch, and upsert-eviction orderings. Also add an end-to-end test in tstest/integration showing that a MapResponse reusing an address is handled incrementally rather than as a full netmap, and that LocalBackend.WhoIs still resolves the reused address afterwards, which is the lookup PeerAPI makes before it accepts a connection. Updates tailscale/corp#47435 Co-authored-by: Brendan Creane <bcreane@gmail.com> Signed-off-by: Brendan Creane <bcreane@gmail.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I3f8c2a9d41e07b6a5cd2e94f78b013c6ad2f5e91 (cherry picked from commit 2ae2808) * ipn/ipnlocal: preserve peer deltas on expiry Refresh the expiry timer netmap from the live peer state before reinstalling it, preventing delta updates from being rolled back. Updates tailscale/corp#47686 Change-Id: Idc738acea82bab5a8ba772084a41e55b38a06bcc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> (cherry picked from commit 0640312) * control/controlclient: replay user profiles on delta peer upserts A full netmap carries only the profiles of users with a currently visible peer (netmapForResponse), and nodeBackend replaces its live profile set wholesale on every full netmap install. A full netmap that arrives while a user has no visible peer therefore drops that user's profile downstream. When a peer of that user later returns as an incremental upsert, control does not resend the profile, because MapResponse.UserProfiles has carried only new or updated profiles since mapver 5. The upsert indexes the node by address and key, so WireGuard admits its traffic, but WhoIs then fails one step later at the user profile lookup, surfacing as "peerapi: unknown peer" until the next full netmap. It is a second, independent cause of the symptom fixed by the recent index eviction change. mapSession.lastUserProfile holds the profile the whole time, so when handling a response incrementally, also deliver the profiles of upserted peers' users (and sharers) from that store, before the mutations that reference them. The backport adapts the new tests to this branch's extra viaTSMP parameter on handleNonKeepAliveMapResponse. Updates tailscale/corp#47435 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I9c4b2f6a8e0d47d3b1a5c2e7f4098d61b23a7c50 (cherry picked from commit 5201273) --------- Signed-off-by: M. J. Fromberger <fromberger@tailscale.com> Signed-off-by: Brendan Creane <bcreane@gmail.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: M. J. Fromberger <fromberger@tailscale.com> Co-authored-by: Brendan Creane <bcreane@gmail.com>
…ndler The service-pg-reconciler reconciles Services annotated for an ingress ProxyGroup, but its ProxyGroup watch reused ingressProxyGroupFilter, which is ingressesFromIngressProxyGroup. That handler lists Ingresses and returns Ingress keys, so when a ProxyGroup became Available the requests it produced never matched a Service and the reconciler's Get just came back NotFound. This fixes this by adding servicesFromIngressProxyGroup, which lists the Services indexed for the ProxyGroup and returns their keys, matching what the egress path already does with egressSvcsFromEgressProxyGroup. Fixes tailscale#20944 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> (cherry picked from commit 1de85e1)
Signed-off-by: Nick O'Neill <nick@tailscale.com>
) (tailscale#21407) * cmd/k8s-operator: move egress EndpointSlice write back into gated provision PR tailscale#20347 moved the EndpointSlice createOrUpdate outside of provision, causing it to run on every reconcile. This resulted in racing egress-eps on the EndpointSlice, sometimes causing the TailscaleEgressSvcConfigured to become stuck as False with the Service not fully updated. Gate it again so it only runs when a reprovision is required. Updates tailscale#20916 * cmd/k8s-operator: recover missing egress EndpointSlices Add a watch for EndpointSlices in the egress-services reconciler so a deleted slice re-triggers a Service reconcile directly. Treat a Service whose expected per-family EndpointSlice is missing as not up to date so it re-enters provision and recreates the slice. Also sort endpoints by Pod UID before writing them in the egress-eps reconciler, so an unchanged set of ready Pods cannot result in a different order and trigger an unnecessary Update. Updates tailscale#20916 --------- (cherry picked from commit 7bf7669) Signed-off-by: Becky Pauley <becky@tailscale.com>
…ailscale#21431) When containerboot falls behind on the IPN bus, tailscaled closes the watch. containerboot treated the EOF as fatal and SIGTERMed a healthy tailscaled, which is easy to hit on large, churny tailnets. Instead, reconnect and rebuild state from the new watch's initial status, and only request peer changes in modes that use them. If the watch can't be reopened for a minute, exit so a dead tailscaled still restarts the container. Fixes tailscale#21373 Change-Id: Iad7749e4fd0f43eabdb471d6e64bb43f37ff70ff (cherry picked from commit 5f0cf87) Signed-off-by: Raj Singh <raj@tailscale.com> Co-authored-by: Raj Singh <raj@tailscale.com>
…ailscale#21458) This change adds an entry point for oss-fuzz `fuzz/oss-fuzz.sh`, allowing us to wire in our current and future fuzzing into oss-fuzz without needing to update the google/oss-fuzz repo. Existing fuzzing was also reviewed with the following changes: * disco/disco_fuzzer.go renamed to disco/fuzz_test.go so that it can have a _test.go suffix and match the modern go fuzzing design. * net/stun/stun_fuzzer.go renamed to net/stun/fuzz_test.go similar to the above * Disco and stun recieved seeds for their fuzzing starts * All existing fuzzing was given a local round of testing, which resulted in a round trip fix for disco not handling a full zero node key. * Running and building fuzzing was removed from CI (build only). The fuzz seeds are validated in normal go testing, but the fuzzing itself will only happen if run manually or on oss-fuzz. Updates tailscale/corp#46608 Change-Id: I47cb70169aefb02ac5a56220f26a6ec07fa135ee (cherry picked from commit fae8f24) Signed-off-by: Mike Jensen <mikej@tailscale.com> Co-authored-by: Mike Jensen <mikej@tailscale.com>
…ailscale#21332) (tailscale#21445) Returning from injectToHost and injectToWireGuard leaves the two goroutines dead and the host without having a way to send traffic. This is especially relevant for android where the tundev is torn down and recreated for every call to updateTUN() from a route table change or roaming between networks. Fixes tailscale#21155 Signed-off-by: Claus Lensbøl <claus@tailscale.com> (cherry picked from commit 3f3e56f) (this effectively more of a backport than a cherry pick)
…error (tailscale#21332) (tailscale#21445)" This reverts commit 8810957.
…#20862) (tailscale#21458)" This reverts commit 93eeec1.
…scale#21174) (tailscale#21407)" This reverts commit e494389.
Signed-off-by: Nick O'Neill <nick@tailscale.com>
Revert some release branch changes for a smaller .5 release
Release 1.102.5
Collaborator
Author
|
Superseded by #37 |
ChandonPierre
added a commit
that referenced
this pull request
Oct 28, 2026
Supersedes #36 This takes this repo from v1.98.5 -> v1.104.4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://tailscale.com/changelog#2026-09-24
This takes this repo from v1.98.5 -> v1.102.5