2020-02-03 18:35:52 +00:00
|
|
|
// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package ipn
|
|
|
|
|
|
|
|
import (
|
ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows
This partially (but not yet fully) migrates Windows to tailscaled's
StateStore storage system.
This adds a new bool Pref, ForceDaemon, defined as:
// ForceDaemon specifies whether a platform that normally
// operates in "client mode" (that is, requires an active user
// logged in with the GUI app running) should keep running after the
// GUI ends and/or the user logs out.
//
// The only current applicable platform is Windows. This
// forced Windows to go into "server mode" where Tailscale is
// running even with no users logged in. This might also be
// used for macOS in the future. This setting has no effect
// for Linux/etc, which always operate in daemon mode.
Then, when ForceDaemon becomes true, we now write use the StateStore
to track which user started it in server mode, and store their prefs
under that key.
The ipnserver validates the connections/identities and informs that
LocalBackend which userid is currently in charge.
The GUI can then enable/disable server mode at runtime, without using
the CLI.
But the "tailscale up" CLI was also fixed, so Windows users can use
authkeys or ACL tags, etc.
Updates #275
2020-10-12 21:28:21 +00:00
|
|
|
"bytes"
|
2020-02-03 18:35:52 +00:00
|
|
|
"encoding/json"
|
|
|
|
"errors"
|
2020-09-30 03:51:25 +00:00
|
|
|
"fmt"
|
2020-02-03 18:35:52 +00:00
|
|
|
"io/ioutil"
|
2020-11-06 20:56:24 +00:00
|
|
|
"log"
|
2020-02-03 18:35:52 +00:00
|
|
|
"os"
|
2020-03-03 19:51:44 +00:00
|
|
|
"path/filepath"
|
2020-02-03 18:35:52 +00:00
|
|
|
"sync"
|
|
|
|
|
|
|
|
"tailscale.com/atomicfile"
|
2021-09-21 21:00:30 +00:00
|
|
|
"tailscale.com/paths"
|
2020-02-03 18:35:52 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// ErrStateNotExist is returned by StateStore.ReadState when the
|
2020-02-11 05:46:45 +00:00
|
|
|
// requested state ID doesn't exist.
|
|
|
|
var ErrStateNotExist = errors.New("no state with given ID")
|
2020-02-03 18:35:52 +00:00
|
|
|
|
2020-09-30 03:51:25 +00:00
|
|
|
const (
|
2020-09-28 22:28:26 +00:00
|
|
|
// MachineKeyStateKey is the key under which we store the machine key,
|
2020-12-30 01:22:56 +00:00
|
|
|
// in its wgkey.Private.MarshalText representation.
|
2020-09-28 22:28:26 +00:00
|
|
|
MachineKeyStateKey = StateKey("_machinekey")
|
|
|
|
|
2020-09-30 03:51:25 +00:00
|
|
|
// GlobalDaemonStateKey is the ipn.StateKey that tailscaled
|
|
|
|
// loads on startup.
|
|
|
|
//
|
|
|
|
// We have to support multiple state keys for other OSes (Windows in
|
|
|
|
// particular), but right now Unix daemons run with a single
|
|
|
|
// node-global state. To keep open the option of having per-user state
|
|
|
|
// later, the global state key doesn't look like a username.
|
|
|
|
GlobalDaemonStateKey = StateKey("_daemon")
|
ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows
This partially (but not yet fully) migrates Windows to tailscaled's
StateStore storage system.
This adds a new bool Pref, ForceDaemon, defined as:
// ForceDaemon specifies whether a platform that normally
// operates in "client mode" (that is, requires an active user
// logged in with the GUI app running) should keep running after the
// GUI ends and/or the user logs out.
//
// The only current applicable platform is Windows. This
// forced Windows to go into "server mode" where Tailscale is
// running even with no users logged in. This might also be
// used for macOS in the future. This setting has no effect
// for Linux/etc, which always operate in daemon mode.
Then, when ForceDaemon becomes true, we now write use the StateStore
to track which user started it in server mode, and store their prefs
under that key.
The ipnserver validates the connections/identities and informs that
LocalBackend which userid is currently in charge.
The GUI can then enable/disable server mode at runtime, without using
the CLI.
But the "tailscale up" CLI was also fixed, so Windows users can use
authkeys or ACL tags, etc.
Updates #275
2020-10-12 21:28:21 +00:00
|
|
|
|
|
|
|
// ServerModeStartKey's value, if non-empty, is the value of a
|
|
|
|
// StateKey containing the prefs to start with which to start the
|
|
|
|
// server.
|
|
|
|
//
|
|
|
|
// For example, the value might be "user-1234", meaning the
|
|
|
|
// the server should start with the Prefs JSON loaded from
|
|
|
|
// StateKey "user-1234".
|
|
|
|
ServerModeStartKey = StateKey("server-mode-start-key")
|
2020-09-30 03:51:25 +00:00
|
|
|
)
|
|
|
|
|
2020-02-03 18:35:52 +00:00
|
|
|
// StateStore persists state, and produces it back on request.
|
|
|
|
type StateStore interface {
|
2020-02-11 05:46:45 +00:00
|
|
|
// ReadState returns the bytes associated with ID. Returns (nil,
|
|
|
|
// ErrStateNotExist) if the ID doesn't have associated state.
|
2020-02-03 18:35:52 +00:00
|
|
|
ReadState(id StateKey) ([]byte, error)
|
2020-02-11 05:46:45 +00:00
|
|
|
// WriteState saves bs as the state associated with ID.
|
2020-02-03 18:35:52 +00:00
|
|
|
WriteState(id StateKey, bs []byte) error
|
|
|
|
}
|
|
|
|
|
|
|
|
// MemoryStore is a store that keeps state in memory only.
|
|
|
|
type MemoryStore struct {
|
|
|
|
mu sync.Mutex
|
|
|
|
cache map[StateKey][]byte
|
|
|
|
}
|
|
|
|
|
2020-09-30 03:51:25 +00:00
|
|
|
func (s *MemoryStore) String() string { return "MemoryStore" }
|
|
|
|
|
2020-02-11 05:46:45 +00:00
|
|
|
// ReadState implements the StateStore interface.
|
2020-02-03 18:35:52 +00:00
|
|
|
func (s *MemoryStore) ReadState(id StateKey) ([]byte, error) {
|
|
|
|
s.mu.Lock()
|
|
|
|
defer s.mu.Unlock()
|
|
|
|
bs, ok := s.cache[id]
|
|
|
|
if !ok {
|
|
|
|
return nil, ErrStateNotExist
|
|
|
|
}
|
|
|
|
return bs, nil
|
|
|
|
}
|
|
|
|
|
2020-02-11 05:46:45 +00:00
|
|
|
// WriteState implements the StateStore interface.
|
2020-02-03 18:35:52 +00:00
|
|
|
func (s *MemoryStore) WriteState(id StateKey, bs []byte) error {
|
|
|
|
s.mu.Lock()
|
|
|
|
defer s.mu.Unlock()
|
|
|
|
if s.cache == nil {
|
|
|
|
s.cache = map[StateKey][]byte{}
|
|
|
|
}
|
|
|
|
s.cache[id] = append([]byte(nil), bs...)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// FileStore is a StateStore that uses a JSON file for persistence.
|
|
|
|
type FileStore struct {
|
|
|
|
path string
|
|
|
|
|
|
|
|
mu sync.RWMutex
|
|
|
|
cache map[StateKey][]byte
|
|
|
|
}
|
|
|
|
|
2020-09-30 03:51:25 +00:00
|
|
|
func (s *FileStore) String() string { return fmt.Sprintf("FileStore(%q)", s.path) }
|
|
|
|
|
2020-02-03 18:35:52 +00:00
|
|
|
// NewFileStore returns a new file store that persists to path.
|
|
|
|
func NewFileStore(path string) (*FileStore, error) {
|
2021-09-24 21:24:16 +00:00
|
|
|
// We unconditionally call this to ensure that our perms are correct
|
|
|
|
if err := paths.MkStateDir(filepath.Dir(path)); err != nil {
|
|
|
|
return nil, fmt.Errorf("creating state directory: %w", err)
|
|
|
|
}
|
|
|
|
|
2020-02-03 18:35:52 +00:00
|
|
|
bs, err := ioutil.ReadFile(path)
|
2020-11-06 20:56:24 +00:00
|
|
|
|
|
|
|
// Treat an empty file as a missing file.
|
|
|
|
// (https://github.com/tailscale/tailscale/issues/895#issuecomment-723255589)
|
|
|
|
if err == nil && len(bs) == 0 {
|
|
|
|
log.Printf("ipn.NewFileStore(%q): file empty; treating it like a missing file [warning]", path)
|
|
|
|
err = os.ErrNotExist
|
|
|
|
}
|
|
|
|
|
2020-02-03 18:35:52 +00:00
|
|
|
if err != nil {
|
|
|
|
if os.IsNotExist(err) {
|
|
|
|
// Write out an initial file, to verify that we can write
|
|
|
|
// to the path.
|
|
|
|
if err = atomicfile.WriteFile(path, []byte("{}"), 0600); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &FileStore{
|
|
|
|
path: path,
|
|
|
|
cache: map[StateKey][]byte{},
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
ret := &FileStore{
|
|
|
|
path: path,
|
|
|
|
cache: map[StateKey][]byte{},
|
|
|
|
}
|
|
|
|
if err := json.Unmarshal(bs, &ret.cache); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return ret, nil
|
|
|
|
}
|
|
|
|
|
2020-02-11 05:46:45 +00:00
|
|
|
// ReadState implements the StateStore interface.
|
2020-02-03 18:35:52 +00:00
|
|
|
func (s *FileStore) ReadState(id StateKey) ([]byte, error) {
|
|
|
|
s.mu.RLock()
|
|
|
|
defer s.mu.RUnlock()
|
|
|
|
bs, ok := s.cache[id]
|
|
|
|
if !ok {
|
|
|
|
return nil, ErrStateNotExist
|
|
|
|
}
|
|
|
|
return bs, nil
|
|
|
|
}
|
|
|
|
|
2020-02-11 05:46:45 +00:00
|
|
|
// WriteState implements the StateStore interface.
|
2020-02-03 18:35:52 +00:00
|
|
|
func (s *FileStore) WriteState(id StateKey, bs []byte) error {
|
|
|
|
s.mu.Lock()
|
|
|
|
defer s.mu.Unlock()
|
ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows
This partially (but not yet fully) migrates Windows to tailscaled's
StateStore storage system.
This adds a new bool Pref, ForceDaemon, defined as:
// ForceDaemon specifies whether a platform that normally
// operates in "client mode" (that is, requires an active user
// logged in with the GUI app running) should keep running after the
// GUI ends and/or the user logs out.
//
// The only current applicable platform is Windows. This
// forced Windows to go into "server mode" where Tailscale is
// running even with no users logged in. This might also be
// used for macOS in the future. This setting has no effect
// for Linux/etc, which always operate in daemon mode.
Then, when ForceDaemon becomes true, we now write use the StateStore
to track which user started it in server mode, and store their prefs
under that key.
The ipnserver validates the connections/identities and informs that
LocalBackend which userid is currently in charge.
The GUI can then enable/disable server mode at runtime, without using
the CLI.
But the "tailscale up" CLI was also fixed, so Windows users can use
authkeys or ACL tags, etc.
Updates #275
2020-10-12 21:28:21 +00:00
|
|
|
if bytes.Equal(s.cache[id], bs) {
|
|
|
|
return nil
|
|
|
|
}
|
2020-02-03 18:35:52 +00:00
|
|
|
s.cache[id] = append([]byte(nil), bs...)
|
|
|
|
bs, err := json.MarshalIndent(s.cache, "", " ")
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return atomicfile.WriteFile(s.path, bs, 0600)
|
|
|
|
}
|