v1.54.0-sunos

Builds

• deps: bump @babel/traverse from 7.22.10 to 7.23.2 in /client/web #66,#9822 (dependabot[bot])
• deps: bump get-func-name from 2.0.0 to 2.0.2 in /client/web #66,#9565 (dependabot[bot])
• deps-dev: bump postcss from 8.4.27 to 8.4.31 in /client/web #66,#9708 (dependabot[bot])
• deps: bump github.com/docker/docker #66,#10017 (dependabot[bot])

Commits

• fde2ba5: VERSION.txt: this is v1.53.0 (tailscale#10018) (Tyler Smalley) #66,#10018
• ed1b935: cmd/k8s-operator: allow to install operator via helm (tailscale#9920) (Irbe Krumina) #66,#9920
• download helm CLI (tailscale#9981) #66,#9981 (Irbe Krumina)
• enable use-cases with non-native IPs by setting ns.ProcessSubnets #66,#9958 (Tom DNetto)
• 57c5b5a: net/dns/recursive: update IP for b.root-servers.net (Andrew Dunham) #66,#9998
• 95715c4: ipn/localapi: add endpoint to handle APNS payloads (tailscale#9972) (Andrea Gottardo) #66,#9972
• 93aa8a8: client/web: allow providing logger implementation (Sonia Appasamy) #66,#10028
• 89953b0: ipn/ipnlocal,client/web: add web client to tailscaled (Sonia Appasamy) #66,#10028
• 6f214de: client/web: split out UI components (Sonia Appasamy) #66,#10028
• dd842d4: go.mod: update wireguard-go to enable TUN UDP GSO/GRO (tailscale#10029) (Jordan Whited) #66,#10029
• add user pref for running web client #66,#9987 (Will Norris)
• serve web client requests from LocalBackend #66,#9987 (Will Norris)
• 0d86eb9: go.mod.sri: update SRI hash for go.mod changes (Flakes Updater) #66,#10030
• a7c80c3: cmd/sniproxy: implement support for control configuration, multiple addresses (Tom DNetto) #66,#9892
• df4b730: types/appctype: define the nodeAttrs type for dns-driven app connectors (Tom DNetto) #66,#10032
• 3d7fb6c: derp/derphttp: fix race in mesh watcher (Brad Fitzpatrick) #66,#9977
• 3114a1c: derp/derphttp: add watch reconnection tests from tailscale#9719 (Anton Tolchanov) #66,#9977
• 4417565: ipn/ipnlocal: rename web fields/structs to webClient (Sonia Appasamy) #66,#10034
• mention release track when running latest (tailscale#10039) #66,#10039 (Andrew Lytvynov)
• 00375f5: util/set: add some more Set operations (tailscale#10022) (Chris Palmer) #66,#10022
• bd488e4: go.mod: update wireguard-go (tailscale#10046) (Jordan Whited) #66,#10046
• replace web client debug flag with node capability #66,#10033 (Will Norris)
• c331313: derp/derphttp: close DERP client to avoid data race in test (Anton Tolchanov) #66,#10042
• d601c81: wgengine/netstack: use netip.Prefix as map keys (Maisem Ali) #66,#9950
• eaf8aa6: wgengine/netstack: remove unnecessary map in UpdateNetstackIPs (Maisem Ali) #66,#9950
• d0f2c06: wgengine/netstack: standardize var names in UpdateNetstackIPs (Maisem Ali) #66,#9950
• c2b87fc: cmd/k8s-operator/deploy/chart,.github/workflows: use helm chart API v2 (tailscale#10055) (Irbe Krumina) #66,#10055
• disable on Unraid (tailscale#10048) #66,#10048 (Derek Kaser)
• 3a9f5c0: util/set: make Clone a method (tailscale#10044) (Chris Palmer) #66,#10044
• 32ebc03: client/web: move session logic to auth.go (Sonia Appasamy) #66,#10060
• 09fcbae: net/dnscache: remove completed TODO (James Tucker) #66,#9999
• introduce app connector advertisement preference and flags #66,#9989 (James Tucker)
• 970eb5e: cmd/k8s-operator: sanitize connection headers (tailscale#10063) (Rhea Ghosh) #66,#10063
• 237c6c4: client/web: call /api/auth before rendering any client views (Will Norris) #66,#10062
• 0ee4573: ipn/ipnlocal: fix small typo (James Tucker) #66,#10065
• 3786320: cmd/k8s-operator: strip credentials from client config in noauth mode (David Anderson) #66,#10067
• fix a couple of logic simplification lints #66,#10066 (James Tucker)
• clarify how to run update as Administrator on Windows (tailscale#10043) #66,#10043 (Andrew Lytvynov)
• b1a0caf: .github: Bump actions/checkout from 3 to 4 (dependabot[bot]) #66,#10016
• e5fbe57: web/client: update synology token from /api/auth call (Will Norris) #66,#10068
• 7a725bb: client/web: move more session logic to auth.go (Sonia Appasamy) #66,#10069
• e7482f0: ipn/ipnlocal: prevent deadlock on WebClientShutdown (Will Norris) #66,#10073
• b48b7d8: appc,ipn/ipnlocal,net/dns/resolver: add App Connector wiring when enabled in prefs (James Tucker) #66,#10038
• e9de59a: tstest/deptest: fix minor escaping error in regex (James Tucker) #66,#10074
• 6ad54fe: appc,ipn/ipnlocal: add App Connector domain configuration from mapcap (James Tucker) #66,#10040
• 228a82f: ipn/ipnlocal,tailcfg: add AppConnector service to HostInfo when configured (James Tucker) #66,#10064
• 673ff2c: util/groupmember: fail earlier if group doesn't exist, use slices.Contains (Brad Fitzpatrick) #66,#10077
• af49bca: cmd/k8s-operator: set different app type for operator with proxy (tailscale#10081) (Irbe Krumina) #66,#10081
• 47019ce: cmd/tailscaled: pre-load wintun.dll using a fully-qualified path (Aaron Klotz) #66,#10083
• c6a4612: ipn/localapi: require Write access on /watch-ipn-bus with private keys (tailscale#10059) (Andrew Lytvynov) #66,#10059
• b370274: ipn/ipnlocal: pull CapabilityPreviewWebClient into webClientAtomicBool (Sonia Appasamy) #66,#10088
• da31ce3: ipn/localapi: remove webclient endpoint (Sonia Appasamy) #66,#10087
• aa5af06: ipn/ipnlocal: include web client port in setTCPPortsIntercepted (Sonia Appasamy) #66,#10086
• cleanup SPK and MSI downloads (tailscale#10085) #66,#10085 (Andrew Lytvynov)
• f27b2cf: appc,cmd/sniproxy,ipn/ipnlocal: split sniproxy configuration code out of appc (James Tucker) #66,#10075
• 4ce4bb6: client/web: limit authorization checks to API calls (Will Norris) #66,#10091
• do not recursively delete dirs in cleanupOldDownloads (tailscale#10093) #10093 (Andrew Lytvynov)
• 191e2ce: client/web: add ServerMode to web.Server (Sonia Appasamy) #10092
• f0bc95a: ipn/localapi: make serveTKASign require write permission (tailscale#10094) (Andrew Lytvynov) #10094
• 0ecfc1d: client/web: fill devMode from an env var (Sonia Appasamy) #10096
• 46fd488: types/dnstype: update the usage documentation on dnstype.Resolver (James Tucker) #10076
• 658971d: ipn/ipnlocal: serve web client on quad100 if enabled (Will Norris) #10109
• e5dcf7b: client/web: move auth session creation out of /api/auth (Sonia Appasamy) #10111
• fbc1841: ipn/ipnauth: improve the Windows token administrator check (Aaron Klotz) #10037
• 6b956b4: client/web: add some security checks for full client (Will Norris) #10103
• a05ab9f: client/web: check r.Host rather than r.URL.Host (Will Norris) #10114
• cb07ed5: go.mod: update web-client-prebuilt (Will Norris) #10115
• 7e81c83: cmd/tailscale: respect existing web client pref (Will Norris) #10117
• 8dc6de6: go.mod.sri: update SRI hash for go.mod changes (Flakes Updater) #10047
• b2b8362: derp/derphttp: fix derptrack fix (Brad Fitzpatrick) #10123
• add Allow LAN Access visibility key (tailscale#10113) #10113 (Claire Wang)
• e537d30: client/web: relax CSP restrictions for manage client (Will Norris) #10119
• 1a1e0f4: client/tailscale: remove redundant error check (Matt Layher) #10112
• c87d580: control/controlclient: move lastPrintMap field from Direct to mapSession (Brad Fitzpatrick) #10129
• 44c6909: control/controlclient: move watchdog out of mapSession (Brad Fitzpatrick) #10130
• ef6a6e9: derp/derphttp: use a getter method to read server key (Anton Tolchanov) #10135
• aba4bd0: util/winutil: simplify dropping privileges after use (tailscale#10099) (Andrew Lytvynov) #10099
• f2a4c4f: client/web: build out client home page (Sonia Appasamy) #10118
• update tailscale{,d} licenses #10031 (License Updater)
• update win/apple licenses #9990 (License Updater)
• 7df2c5d: client/web: add route management for ui pages (Sonia Appasamy) #10121
• 942d720: cli/web: don't block startup on status req (Sonia Appasamy) #10097
• 3269b36: client/web: fix hotreload proxy (Sonia Appasamy) #10140
• 839fee9: wgengine/magicsock: handle wireguard only clean up and log messages (Charlotte Brandhorst-Satzkorn) #9002
• 96a80fc: Add support for custom DERP port in TLS prober (Thomas Kosiewski) #10145
• 3e9026e: client/web: show manage button in readonly view (Will Norris) #10120
• d73e923: client/web: add device details view (Sonia Appasamy) #10143
• de2af54: client/web: pipe newSession through to readonly view (Sonia Appasamy) #10149
• 5e095dd: client/web: add initial framework for exit node selector (Sonia Appasamy) #10152
• d530153: go.mod: bump web-client-prebuilt (Will Norris) #10153
• 0753ad6: client/web: move useNodeData out of App component (Sonia Appasamy) #10156
• 623f669: client/web: pass URL prefix to frontend (Will Norris) #10158
• fc2d63b: go.mod: updates web-client-prebuilt (Will Norris) #10159
• 9b158db: ipn/localapi: require root or sudo+operator access for SetServeConfig (tailscale#10142) (Andrew Lytvynov) #10142
• check whether running as root early (tailscale#10161) #10161 (Andrew Lytvynov)
• f937cb6: tailcfg,ipn,appc: add c2n endpoint for appc domain routes (Charlotte Brandhorst-Satzkorn) #10162
• fdbe511: cmd/tailscale: add -webclient flag to up and set (Will Norris) #10167
• 3496d62: ipn/ipnlocal: add empty address to the app-connector localNets set (Tom DNetto) #10164
• 11a20f3: ipn/ipnlocal: fix nil control client panic while updating TKA head (Tom DNetto) #10160
• fix Logger.Write return result #10173 (Brad Fitzpatrick)
• d544e80: client/web: populate device details view (Sonia Appasamy) #10175
• bff7865: clientupdate,ipn/ipnlocal: fix c2n update on freebsd (tailscale#10168) (Andrew Lytvynov) #10168
• check a bit harder for https in Server.ListenFunnel #10183 (Brad Fitzpatrick)
• 09de240: ipn/ipnlocal: allow connecting to local web client (Will Norris) #10177
• 1fc1077: ssh/tailssh,util: extract new osuser package from ssh code (tailscale#10170) (Andrew Lytvynov) #10170
• 12d5c99: client/tailscale,ipn/{ipnlocal,localapi}: check UDP GRO config (tailscale#10071) (Jordan Whited) #10071
• add support for matching wildcard domains #10171 (James Tucker)
• 55cd5c5: ipn/localapi: only perform local-admin check in serveServeConfig (tailscale#10163) (Andrew Lytvynov) #10163
• e57fd9c: ipn/{ipnlocal,ipnstate,localapi}: add localapi endpoints for client self-update (tailscale#10188) (Naman Sood) #10188
• ffabe5f: ssh/tailssh: fix sftp metric increment location (Brad Fitzpatrick) #10190
• 53c4adc: ssh/tailssh: add envknobs to force override forwarding, sftp, pty (Brad Fitzpatrick) #10192
• 6cce5fe: go.toolchain.rev: bump to Go 1.21.4 (tailscale#10189) (Andrew Lytvynov) #10189
• prevent duplication of wildcard entries on map updates #10197 (James Tucker)
• 933d201: ipn/policy: mark AppConnector service as interesting (James Tucker) #10198
• 45be37c: ipn/ipnlocal: ensure that hostinfo is updated on app connector preference changes (James Tucker) #10199
• add support for QNAP (tailscale#10179) #10179 (Andrew Lytvynov)
• 0b66362: tailcfg,ipn/ipnlocal: add hostinfo field to replace service entry (James Tucker) #10202
• c54d680: ipn,tailconfig: clean up unreleased and removed app connector service (James Tucker) #10203
• 86c8ab7: client/web: add readonly/manage toggle (Sonia Appasamy) #10193
• ignore not found serial errors #10224 (Kristoffer Dalby)
• e848736: control/controlknobs,wgengine/magicsock: implement SilentDisco toggle (tailscale#10195) (Jordan Whited) #10195
• lazily perform full deletion scan after first taildrop use (tailscale#10137) #10137 (Joe Tsai)
• ce46d92: go.{mod,sum}: update inet.af/tcpproxy to fix flaking test (Tom DNetto) #10227
• 103c00a: ipn/ipnlocal: clean up c2n handling's big switch, add a mux table (Brad Fitzpatrick) #10226
• c9bfb7c: client/web: add Tailscale SSH view (Sonia Appasamy) #10228
• 1825d23: ipn/ipnlocal: respect ExitNodeAllowLANAccess on iOS (tailscale#10230) (Brad Fitzpatrick) #10230
• 90a0aaf: cmd/tailscale: warn if app-connector is enabled without ip forwarding (Tom DNetto) #10231
• c99488e: wgengine/magicsock: fix typo in endpoint.sendDiscoPing() docs (tailscale#10232) (Jordan Whited) #10232
• 955e2fc: ipn/ipnlocal: run "tailscale update" via systemd-run on Linux (tailscale#10229) (Andrew Lytvynov) #10229
• 7399e56: .github: add action for updating web-client-prebuilt module (Will Norris) #10240
• 063657c: go.mod: update web-client-prebuilt module (OSS Updater) #10241
• 7c99a17: client/web: fix panic on logout (Sonia Appasamy) #10246
• 79719f0: ipn/ipnlocal: remove web client listeners after close (Will Norris) #10247
• 74947ce: client/web: only trigger check mode if not authed (Will Norris) #10245
• fb984c2: client/web: server /index.html on 404 requests (Will Norris) #10250
• 60957e1: client/web: fix back button on devices with URL prefix (Will Norris) #10249
• fix auto-update on Windows over RDP (tailscale#10242) #10242 (Andrew Lytvynov)
• e3dacb3: go.mod.sri: update SRI hash for go.mod changes (Flakes Updater) #10154
• b791834: ipn/ipnlocal: call serve handler for local traffic (Will Norris) #10251
• 05d4210: adjust build tags for tamago (Andrea Barisani) #10252
• 1cb8d2f: ipn/ipnlocal: only call serve handler if non-nil (Will Norris) #10254
• bb31912: cmd/cli: remove --webclient flag from up (Sonia Appasamy) #10256
• e866ee9: types/appctype: correct app-connector cap name in documentation (James Tucker) #10196
• c82fd12: VERSION.txt: this is v1.54.0 (Denton Gentry)
• 978290d: illumos/solaris support rebased onto 1.54.0 (Nahum Shalman)