make reauth test compat with tailscale head (#2167)

* make reauth test compat with tailscale head

tailscale/tailscale@1eaad7d broke our reauth test as it makes the client
retry with https/443 if it reconnects within 2 minutes.

This commit fixes this by running the test as a two part,
- with https, to confirm instant reconnect works
- with http, and a 3 min wait, to check that it work without.

The change is not a general consern as headscale in prod is ran
with https.

Updates #2164

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

* sort test for stable order

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

---------

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

hscontrol/db/preauth_keys_test.go

@@ -1,6 +1,7 @@
 package db
 
 import (
+	"sort"
 	"time"
 
 	"github.com/juanfont/headscale/hscontrol/types"
@@ -169,5 +170,7 @@ func (*Suite) TestPreAuthKeyACLTags(c *check.C) {
 
 	listedPaks, err := db.ListPreAuthKeys("test8")
 	c.Assert(err, check.IsNil)
-	c.Assert(listedPaks[0].Proto().GetAclTags(), check.DeepEquals, tags)
+	gotTags := listedPaks[0].Proto().GetAclTags()
+	sort.Sort(sort.StringSlice(gotTags))
+	c.Assert(gotTags, check.DeepEquals, tags)
 }

integration/general_test.go

@@ -107,6 +107,8 @@ func TestAuthKeyLogoutAndRelogin(t *testing.T) {
 	IntegrationSkip(t)
 	t.Parallel()
 
+	for _, https := range []bool{true, false} {
+		t.Run(fmt.Sprintf("with-https-%t", https), func(t *testing.T) {
 			scenario, err := NewScenario(dockertestMaxWait())
 			assertNoErr(t, err)
 			defer scenario.ShutdownAssertNoPanics(t)
@@ -116,7 +118,17 @@ func TestAuthKeyLogoutAndRelogin(t *testing.T) {
 				"user2": len(MustTestVersions),
 			}
 
-	err = scenario.CreateHeadscaleEnv(spec, []tsic.Option{}, hsic.WithTestName("pingallbyip"))
+			opts := []hsic.Option{hsic.WithTestName("pingallbyip")}
+			if https {
+				opts = []hsic.Option{
+					hsic.WithTestName("pingallbyip"),
+					hsic.WithEmbeddedDERPServerOnly(),
+					hsic.WithTLS(),
+					hsic.WithHostnameAsServerURL(),
+				}
+			}
+
+			err = scenario.CreateHeadscaleEnv(spec, []tsic.Option{}, opts...)
 			assertNoErrHeadscaleEnv(t, err)
 
 			allClients, err := scenario.ListTailscaleClients()
@@ -151,6 +163,15 @@ func TestAuthKeyLogoutAndRelogin(t *testing.T) {
 			headscale, err := scenario.Headscale()
 			assertNoErrGetHeadscale(t, err)
 
+			// if the server is not running with HTTPS, we have to wait a bit before
+			// reconnection as the newest Tailscale client has a measure that will only
+			// reconnect over HTTPS if they saw a noise connection previously.
+			// https://github.com/tailscale/tailscale/commit/1eaad7d3deb0815e8932e913ca1a862afa34db38
+			// https://github.com/juanfont/headscale/issues/2164
+			if !https {
+				time.Sleep(3 * time.Minute)
+			}
+
 			for userName := range spec {
 				key, err := scenario.CreatePreAuthKey(userName, true, false)
 				if err != nil {
@@ -212,6 +233,8 @@ func TestAuthKeyLogoutAndRelogin(t *testing.T) {
 					}
 				}
 			}
+		})
+	}
 }
 
 func TestEphemeral(t *testing.T) {