Skip to content

Commit 10ccacf

Browse files
nshalmannshalman
committed
Merge tag 'v1.80.2' into sunos-1.80
Release 1.80.2
2 parents 4193480 + c7a79d7 commit 10ccacf

File tree

9 files changed

+61
-51
lines changed

9 files changed

+61
-51
lines changed

‎VERSION.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.80.0
1+
1.80.2

‎cmd/k8s-operator/depaware.txt

+1
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,7 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
10121012
golang.org/x/net/http2/hpack from golang.org/x/net/http2+
10131013
golang.org/x/net/icmp from github.com/prometheus-community/pro-bing+
10141014
golang.org/x/net/idna from golang.org/x/net/http/httpguts+
1015+
golang.org/x/net/internal/httpcommon from golang.org/x/net/http2
10151016
golang.org/x/net/internal/iana from golang.org/x/net/icmp+
10161017
golang.org/x/net/internal/socket from golang.org/x/net/icmp+
10171018
golang.org/x/net/internal/socks from golang.org/x/net/proxy

‎cmd/tailscale/depaware.txt

+1
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
211211
golang.org/x/net/http2/hpack from net/http+
212212
golang.org/x/net/icmp from tailscale.com/net/ping
213213
golang.org/x/net/idna from golang.org/x/net/http/httpguts+
214+
golang.org/x/net/internal/httpcommon from golang.org/x/net/http2
214215
golang.org/x/net/internal/iana from golang.org/x/net/icmp+
215216
golang.org/x/net/internal/socket from golang.org/x/net/icmp+
216217
golang.org/x/net/internal/socks from golang.org/x/net/proxy

‎cmd/tailscaled/depaware.txt

+1
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
466466
golang.org/x/net/http2/hpack from golang.org/x/net/http2+
467467
golang.org/x/net/icmp from tailscale.com/net/ping+
468468
golang.org/x/net/idna from golang.org/x/net/http/httpguts+
469+
golang.org/x/net/internal/httpcommon from golang.org/x/net/http2
469470
golang.org/x/net/internal/iana from golang.org/x/net/icmp+
470471
golang.org/x/net/internal/socket from golang.org/x/net/icmp+
471472
golang.org/x/net/internal/socks from golang.org/x/net/proxy

‎control/controlclient/map.go

+1-30
Original file line numberDiff line numberDiff line change
@@ -195,10 +195,6 @@ func (ms *mapSession) HandleNonKeepAliveMapResponse(ctx context.Context, resp *t
195195

196196
ms.updateStateFromResponse(resp)
197197

198-
// Occasionally clean up old userprofile if it grows too much
199-
// from e.g. ephemeral tagged nodes.
200-
ms.cleanLastUserProfile()
201-
202198
if ms.tryHandleIncrementally(resp) {
203199
ms.occasionallyPrintSummary(ms.lastNetmapSummary)
204200
return nil
@@ -296,6 +292,7 @@ func (ms *mapSession) updateStateFromResponse(resp *tailcfg.MapResponse) {
296292
for _, up := range resp.UserProfiles {
297293
ms.lastUserProfile[up.ID] = up
298294
}
295+
// TODO(bradfitz): clean up old user profiles? maybe not worth it.
299296

300297
if dm := resp.DERPMap; dm != nil {
301298
ms.vlogf("netmap: new map contains DERP map")
@@ -544,32 +541,6 @@ func (ms *mapSession) addUserProfile(nm *netmap.NetworkMap, userID tailcfg.UserI
544541
}
545542
}
546543

547-
// cleanLastUserProfile deletes any entries from lastUserProfile
548-
// that are not referenced by any peer or the self node.
549-
//
550-
// This is expensive enough that we don't do this on every message
551-
// from the server, but only when it's grown enough to matter.
552-
func (ms *mapSession) cleanLastUserProfile() {
553-
if len(ms.lastUserProfile) < len(ms.peers)*2 {
554-
// Hasn't grown enough to be worth cleaning.
555-
return
556-
}
557-
558-
keep := set.Set[tailcfg.UserID]{}
559-
if node := ms.lastNode; node.Valid() {
560-
keep.Add(node.User())
561-
}
562-
for _, n := range ms.peers {
563-
keep.Add(n.User())
564-
keep.Add(n.Sharer())
565-
}
566-
for userID := range ms.lastUserProfile {
567-
if !keep.Contains(userID) {
568-
delete(ms.lastUserProfile, userID)
569-
}
570-
}
571-
}
572-
573544
var debugPatchifyPeer = envknob.RegisterBool("TS_DEBUG_PATCHIFY_PEER")
574545

575546
// patchifyPeersChanged mutates resp to promote PeersChanged entries to PeersChangedPatch

‎go.mod

+6-6
Original file line numberDiff line numberDiff line change
@@ -94,14 +94,14 @@ require (
9494
go.uber.org/zap v1.27.0
9595
go4.org/mem v0.0.0-20240501181205-ae6ca9944745
9696
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
97-
golang.org/x/crypto v0.32.0
97+
golang.org/x/crypto v0.33.0
9898
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8
9999
golang.org/x/mod v0.22.0
100-
golang.org/x/net v0.34.0
100+
golang.org/x/net v0.35.0
101101
golang.org/x/oauth2 v0.25.0
102-
golang.org/x/sync v0.10.0
103-
golang.org/x/sys v0.29.1-0.20250107080300-1c14dcadc3ab
104-
golang.org/x/term v0.28.0
102+
golang.org/x/sync v0.11.0
103+
golang.org/x/sys v0.30.0
104+
golang.org/x/term v0.29.0
105105
golang.org/x/time v0.9.0
106106
golang.org/x/tools v0.29.0
107107
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
@@ -385,7 +385,7 @@ require (
385385
go.uber.org/multierr v1.11.0 // indirect
386386
golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
387387
golang.org/x/image v0.23.0 // indirect
388-
golang.org/x/text v0.21.0 // indirect
388+
golang.org/x/text v0.22.0 // indirect
389389
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
390390
google.golang.org/protobuf v1.35.1 // indirect
391391
gopkg.in/inf.v0 v0.9.1 // indirect

‎go.sum

+12-12
Original file line numberDiff line numberDiff line change
@@ -1058,8 +1058,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
10581058
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
10591059
golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
10601060
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
1061-
golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
1062-
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
1061+
golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
1062+
golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
10631063
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
10641064
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
10651065
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1148,8 +1148,8 @@ golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
11481148
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
11491149
golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
11501150
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
1151-
golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
1152-
golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
1151+
golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
1152+
golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
11531153
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
11541154
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
11551155
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1171,8 +1171,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
11711171
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
11721172
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
11731173
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
1174-
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
1175-
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
1174+
golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
1175+
golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
11761176
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
11771177
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
11781178
golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1231,16 +1231,16 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
12311231
golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
12321232
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
12331233
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
1234-
golang.org/x/sys v0.29.1-0.20250107080300-1c14dcadc3ab h1:BMkEEWYOjkvOX7+YKOGbp6jCyQ5pR2j0Ah47p1Vdsx4=
1235-
golang.org/x/sys v0.29.1-0.20250107080300-1c14dcadc3ab/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
1234+
golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
1235+
golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
12361236
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
12371237
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
12381238
golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
12391239
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
12401240
golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
12411241
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
1242-
golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
1243-
golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
1242+
golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
1243+
golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
12441244
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
12451245
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
12461246
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1251,8 +1251,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
12511251
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
12521252
golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
12531253
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
1254-
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
1255-
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
1254+
golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
1255+
golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
12561256
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
12571257
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
12581258
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

‎net/netmon/netmon_darwin.go

+13-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,19 @@ func (m *darwinRouteMon) Receive() (message, error) {
5656
if err != nil {
5757
return nil, err
5858
}
59-
msgs, err := route.ParseRIB(route.RIBTypeRoute, m.buf[:n])
59+
msgs, err := func() (msgs []route.Message, err error) {
60+
defer func() {
61+
// #14201: permanent panic protection, as we have been burned by
62+
// ParseRIB panics too many times.
63+
msg := recover()
64+
if msg != nil {
65+
msgs = nil
66+
m.logf("[unexpected] netmon: panic in route.ParseRIB from % 02x", m.buf[:n])
67+
err = fmt.Errorf("panic in route.ParseRIB: %s", msg)
68+
}
69+
}()
70+
return route.ParseRIB(route.RIBTypeRoute, m.buf[:n])
71+
}()
6072
if err != nil {
6173
if debugRouteMessages {
6274
m.logf("read %d bytes (% 02x), failed to parse RIB: %v", n, m.buf[:n], err)

‎ssh/tailssh/tailssh.go

+25-1
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,8 @@ func (srv *server) OnPolicyChange() {
199199
// - ServerConfigCallback
200200
//
201201
// Do the user auth
202-
// - NoClientAuthHandler
202+
// - NoClientAuthHandler or publicKeyHandler
203+
// - fakePasswordHandler if forcing password auth with the `+password` username suffix
203204
//
204205
// Once auth is done, the conn can be multiplexed with multiple sessions and
205206
// channels concurrently. At which point any of the following can be called
@@ -337,6 +338,21 @@ func (c *conn) fakePasswordHandler(ctx ssh.Context, password string) bool {
337338
return c.anyPasswordIsOkay
338339
}
339340

341+
// publicKeyHandler is our implementation of the PublicKeyHandler hook that
342+
// checks whether the user's public key is correct. It exists for clients that
343+
// don't support "none" auth and instead insist on supplying a public key.
344+
// This ignores the supplied public key and authenticates with Tailscale auth
345+
// in the same way as NoClientAuthCallback.
346+
func (c *conn) publicKeyHandler(ctx ssh.Context, pubKey ssh.PublicKey) error {
347+
if err := c.doPolicyAuth(ctx); err != nil {
348+
return err
349+
}
350+
if err := c.isAuthorized(ctx); err != nil {
351+
return err
352+
}
353+
return nil
354+
}
355+
340356
// doPolicyAuth verifies that conn can proceed.
341357
// It returns nil if the matching policy action is Accept or
342358
// HoldAndDelegate. Otherwise, it returns errDenied.
@@ -413,6 +429,14 @@ func (srv *server) newConn() (*conn, error) {
413429
NoClientAuthHandler: c.NoClientAuthCallback,
414430
PasswordHandler: c.fakePasswordHandler,
415431

432+
// The below handler exists for clients that don't support "none" auth
433+
// and insist on supplying a public key. It ignores the supplied key
434+
// and instead uses the same Tailscale auth as NoClientAuthCallback.
435+
//
436+
// As of 2025-02-10, tailssh_integration_test does not exercise this functionality.
437+
// See tailscale/tailscale#14969.
438+
PublicKeyHandler: c.publicKeyHandler,
439+
416440
Handler: c.handleSessionPostSSHAuth,
417441
LocalPortForwardingCallback: c.mayForwardLocalPortTo,
418442
ReversePortForwardingCallback: c.mayReversePortForwardTo,

0 commit comments

Comments
 (0)