tailscale

0 Fork 0

mirror of https://github.com/tailscale/tailscale.git synced 2026-10-31 07:29:36 -04:00

Files

T

James Tucker 55642c2154 cmd/tailscale: add TLS ClientHello size check to debug ts2021

tailscale debug ts2021 now starts with an advisory TLS check against
the control plane over port 443: it compares a TLS 1.3 handshake using
Go's default key exchange groups (which include ML-KEM hybrid
post-quantum groups and produce a large ClientHello) with one
restricted to classic groups (a small ClientHello). If the large
ClientHello fails while the small one succeeds, the network path does
not support large (post-quantum) ClientHellos, likely due to a
middlebox dropping ClientHellos that span multiple TCP segments.

The check honors --connect-ip (dialing that IP while keeping the host
for SNI), can be skipped with --skip-tls-check, and never aborts the
surrounding command.

Updates #21708

Signed-off-by: James Tucker <james@tailscale.com>

2026-10-09 11:30:28 -07:00

addlicense

…

build-webclient

…

checkmetrics

…

cigocacher

go.mod,cmd/cigocacher: migrate to depending on tb (#21627 )

2026-10-02 10:59:48 +01:00

cloner

…