2021-05-14 15:53:55 +00:00
|
|
|
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
// Package tsnet provides Tailscale as a library.
|
|
|
|
//
|
|
|
|
// It is an experimental work in progress.
|
|
|
|
package tsnet
|
|
|
|
|
|
|
|
import (
|
2021-12-01 04:39:12 +00:00
|
|
|
"context"
|
2021-05-14 15:53:55 +00:00
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
"log"
|
|
|
|
"net"
|
2021-10-06 04:40:19 +00:00
|
|
|
"net/http"
|
2021-05-14 15:53:55 +00:00
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
"strings"
|
|
|
|
"sync"
|
|
|
|
"time"
|
|
|
|
|
2021-12-01 04:39:12 +00:00
|
|
|
"inet.af/netaddr"
|
2021-10-06 04:40:19 +00:00
|
|
|
"tailscale.com/client/tailscale"
|
2021-05-14 15:53:55 +00:00
|
|
|
"tailscale.com/control/controlclient"
|
2021-08-26 21:50:55 +00:00
|
|
|
"tailscale.com/envknob"
|
2021-05-14 15:53:55 +00:00
|
|
|
"tailscale.com/ipn"
|
|
|
|
"tailscale.com/ipn/ipnlocal"
|
2021-10-06 04:40:19 +00:00
|
|
|
"tailscale.com/ipn/localapi"
|
|
|
|
"tailscale.com/net/nettest"
|
2021-12-01 04:39:12 +00:00
|
|
|
"tailscale.com/net/tsdial"
|
2021-05-14 15:53:55 +00:00
|
|
|
"tailscale.com/smallzstd"
|
|
|
|
"tailscale.com/types/logger"
|
|
|
|
"tailscale.com/wgengine"
|
|
|
|
"tailscale.com/wgengine/monitor"
|
|
|
|
"tailscale.com/wgengine/netstack"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Server is an embedded Tailscale server.
|
|
|
|
//
|
|
|
|
// Its exported fields may be changed until the first call to Listen.
|
|
|
|
type Server struct {
|
|
|
|
// Dir specifies the name of the directory to use for
|
|
|
|
// state. If empty, a directory is selected automatically
|
|
|
|
// under os.UserConfigDir (https://golang.org/pkg/os/#UserConfigDir).
|
|
|
|
// based on the name of the binary.
|
|
|
|
Dir string
|
|
|
|
|
|
|
|
// Hostname is the hostname to present to the control server.
|
2021-09-01 14:54:49 +00:00
|
|
|
// If empty, the binary name is used.
|
2021-05-14 15:53:55 +00:00
|
|
|
Hostname string
|
|
|
|
|
|
|
|
// Logf, if non-nil, specifies the logger to use. By default,
|
|
|
|
// log.Printf is used.
|
|
|
|
Logf logger.Logf
|
|
|
|
|
2022-02-18 20:55:22 +00:00
|
|
|
// Ephemeral, if true, specifies that the instance should register
|
|
|
|
// as an Ephemeral node (https://tailscale.com/kb/1111/ephemeral-nodes/).
|
2022-02-22 23:32:13 +00:00
|
|
|
Ephemeral bool
|
2022-02-18 20:55:22 +00:00
|
|
|
|
2021-05-14 15:53:55 +00:00
|
|
|
initOnce sync.Once
|
|
|
|
initErr error
|
|
|
|
lb *ipnlocal.LocalBackend
|
|
|
|
// the state directory
|
|
|
|
dir string
|
|
|
|
hostname string
|
|
|
|
|
|
|
|
mu sync.Mutex
|
|
|
|
listeners map[listenKey]*listener
|
2021-12-28 09:06:33 +00:00
|
|
|
dialer *tsdial.Dialer
|
|
|
|
}
|
|
|
|
|
|
|
|
// Dial connects to the address on the tailnet.
|
2022-01-03 19:20:40 +00:00
|
|
|
// It will start the server if it has not been started yet.
|
2021-12-28 09:06:33 +00:00
|
|
|
func (s *Server) Dial(ctx context.Context, network, address string) (net.Conn, error) {
|
2022-01-03 19:20:40 +00:00
|
|
|
if err := s.Start(); err != nil {
|
2021-12-28 09:06:33 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return s.dialer.UserDial(ctx, network, address)
|
2021-05-14 15:53:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) doInit() {
|
|
|
|
if err := s.start(); err != nil {
|
|
|
|
s.initErr = fmt.Errorf("tsnet: %w", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-01-03 19:20:40 +00:00
|
|
|
// Start connects the server to the tailnet.
|
|
|
|
// Optional: any calls to Dial/Listen will also call Start.
|
|
|
|
func (s *Server) Start() error {
|
2021-12-28 09:06:33 +00:00
|
|
|
s.initOnce.Do(s.doInit)
|
|
|
|
return s.initErr
|
|
|
|
}
|
|
|
|
|
2021-05-14 15:53:55 +00:00
|
|
|
func (s *Server) start() error {
|
2021-08-26 21:50:55 +00:00
|
|
|
if !envknob.UseWIPCode() {
|
2021-05-14 15:53:55 +00:00
|
|
|
return errors.New("code disabled without environment variable TAILSCALE_USE_WIP_CODE set true")
|
|
|
|
}
|
|
|
|
|
|
|
|
exe, err := os.Executable()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
prog := strings.TrimSuffix(strings.ToLower(filepath.Base(exe)), ".exe")
|
|
|
|
|
|
|
|
s.hostname = s.Hostname
|
|
|
|
if s.hostname == "" {
|
|
|
|
s.hostname = prog
|
|
|
|
}
|
|
|
|
|
|
|
|
s.dir = s.Dir
|
|
|
|
if s.dir == "" {
|
|
|
|
confDir, err := os.UserConfigDir()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
s.dir = filepath.Join(confDir, "tslib-"+prog)
|
|
|
|
if err := os.MkdirAll(s.dir, 0700); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if fi, err := os.Stat(s.dir); err != nil {
|
|
|
|
return err
|
|
|
|
} else if !fi.IsDir() {
|
|
|
|
return fmt.Errorf("%v is not a directory", s.dir)
|
|
|
|
}
|
|
|
|
|
|
|
|
logf := s.Logf
|
|
|
|
if logf == nil {
|
|
|
|
logf = log.Printf
|
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(bradfitz): start logtail? don't use filch, perhaps?
|
|
|
|
// only upload plumbed Logf?
|
|
|
|
|
|
|
|
linkMon, err := monitor.New(logf)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-12-28 09:06:33 +00:00
|
|
|
s.dialer = new(tsdial.Dialer) // mutated below (before used)
|
2021-05-14 15:53:55 +00:00
|
|
|
eng, err := wgengine.NewUserspaceEngine(logf, wgengine.Config{
|
|
|
|
ListenPort: 0,
|
|
|
|
LinkMonitor: linkMon,
|
2021-12-28 09:06:33 +00:00
|
|
|
Dialer: s.dialer,
|
2021-05-14 15:53:55 +00:00
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
tunDev, magicConn, ok := eng.(wgengine.InternalsGetter).GetInternals()
|
|
|
|
if !ok {
|
|
|
|
return fmt.Errorf("%T is not a wgengine.InternalsGetter", eng)
|
|
|
|
}
|
|
|
|
|
2021-12-28 09:06:33 +00:00
|
|
|
ns, err := netstack.Create(logf, tunDev, eng, magicConn, s.dialer)
|
2021-05-14 15:53:55 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("netstack.Create: %w", err)
|
|
|
|
}
|
2021-10-29 23:21:18 +00:00
|
|
|
ns.ProcessLocalIPs = true
|
2021-05-14 15:53:55 +00:00
|
|
|
ns.ForwardTCPIn = s.forwardTCP
|
|
|
|
if err := ns.Start(); err != nil {
|
|
|
|
return fmt.Errorf("failed to start netstack: %w", err)
|
|
|
|
}
|
2021-12-28 09:06:33 +00:00
|
|
|
s.dialer.UseNetstackForIP = func(ip netaddr.IP) bool {
|
2021-12-01 04:39:12 +00:00
|
|
|
_, ok := eng.PeerForIP(ip)
|
|
|
|
return ok
|
|
|
|
}
|
2021-12-28 09:06:33 +00:00
|
|
|
s.dialer.NetstackDialTCP = func(ctx context.Context, dst netaddr.IPPort) (net.Conn, error) {
|
2021-12-03 16:33:05 +00:00
|
|
|
return ns.DialContextTCP(ctx, dst)
|
2021-12-01 04:39:12 +00:00
|
|
|
}
|
2021-05-14 15:53:55 +00:00
|
|
|
|
|
|
|
statePath := filepath.Join(s.dir, "tailscaled.state")
|
|
|
|
store, err := ipn.NewFileStore(statePath)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
logid := "tslib-TODO"
|
|
|
|
|
2022-02-18 20:55:22 +00:00
|
|
|
loginFlags := controlclient.LoginDefault
|
2022-02-22 23:32:13 +00:00
|
|
|
if s.Ephemeral {
|
2022-02-18 20:55:22 +00:00
|
|
|
loginFlags = controlclient.LoginEphemeral
|
|
|
|
}
|
|
|
|
lb, err := ipnlocal.NewLocalBackend(logf, logid, store, s.dialer, eng, loginFlags)
|
2021-05-14 15:53:55 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("NewLocalBackend: %v", err)
|
|
|
|
}
|
2021-11-07 08:33:49 +00:00
|
|
|
lb.SetVarRoot(s.dir)
|
2021-05-14 15:53:55 +00:00
|
|
|
s.lb = lb
|
|
|
|
lb.SetDecompressor(func() (controlclient.Decompressor, error) {
|
|
|
|
return smallzstd.NewDecoder(nil)
|
|
|
|
})
|
|
|
|
prefs := ipn.NewPrefs()
|
|
|
|
prefs.Hostname = s.hostname
|
|
|
|
prefs.WantRunning = true
|
|
|
|
err = lb.Start(ipn.Options{
|
|
|
|
StateKey: ipn.GlobalDaemonStateKey,
|
|
|
|
UpdatePrefs: prefs,
|
2021-08-08 22:46:30 +00:00
|
|
|
AuthKey: os.Getenv("TS_AUTHKEY"),
|
2021-05-14 15:53:55 +00:00
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("starting backend: %w", err)
|
|
|
|
}
|
2021-08-08 22:46:30 +00:00
|
|
|
if os.Getenv("TS_LOGIN") == "1" || os.Getenv("TS_AUTHKEY") != "" {
|
2021-05-14 15:53:55 +00:00
|
|
|
s.lb.StartLoginInteractive()
|
|
|
|
}
|
2021-10-06 04:40:19 +00:00
|
|
|
|
|
|
|
// Run the localapi handler, to allow fetching LetsEncrypt certs.
|
|
|
|
lah := localapi.NewHandler(lb, logf, logid)
|
|
|
|
lah.PermitWrite = true
|
|
|
|
lah.PermitRead = true
|
|
|
|
|
|
|
|
// Create an in-process listener.
|
|
|
|
// nettest.Listen provides a in-memory pipe based implementation for net.Conn.
|
|
|
|
// TODO(maisem): Rename nettest package to remove "test".
|
|
|
|
lal := nettest.Listen("local-tailscaled.sock:80")
|
|
|
|
|
|
|
|
// Override the Tailscale client to use the in-process listener.
|
|
|
|
tailscale.TailscaledDialer = lal.Dial
|
|
|
|
go func() {
|
|
|
|
if err := http.Serve(lal, lah); err != nil {
|
|
|
|
logf("localapi serve error: %v", err)
|
|
|
|
}
|
|
|
|
}()
|
2021-05-14 15:53:55 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) forwardTCP(c net.Conn, port uint16) {
|
|
|
|
s.mu.Lock()
|
|
|
|
ln, ok := s.listeners[listenKey{"tcp", "", fmt.Sprint(port)}]
|
|
|
|
s.mu.Unlock()
|
|
|
|
if !ok {
|
|
|
|
c.Close()
|
|
|
|
return
|
|
|
|
}
|
|
|
|
t := time.NewTimer(time.Second)
|
|
|
|
defer t.Stop()
|
|
|
|
select {
|
|
|
|
case ln.conn <- c:
|
|
|
|
case <-t.C:
|
|
|
|
c.Close()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-12-28 09:06:33 +00:00
|
|
|
// Listen announces only on the Tailscale network.
|
2022-01-03 19:20:40 +00:00
|
|
|
// It will start the server if it has not been started yet.
|
2021-05-14 15:53:55 +00:00
|
|
|
func (s *Server) Listen(network, addr string) (net.Listener, error) {
|
|
|
|
host, port, err := net.SplitHostPort(addr)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("tsnet: %w", err)
|
|
|
|
}
|
|
|
|
|
2022-01-03 19:20:40 +00:00
|
|
|
if err := s.Start(); err != nil {
|
2021-12-28 09:06:33 +00:00
|
|
|
return nil, err
|
2021-05-14 15:53:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
key := listenKey{network, host, port}
|
|
|
|
ln := &listener{
|
|
|
|
s: s,
|
|
|
|
key: key,
|
|
|
|
addr: addr,
|
|
|
|
|
|
|
|
conn: make(chan net.Conn),
|
|
|
|
}
|
|
|
|
s.mu.Lock()
|
|
|
|
if s.listeners == nil {
|
|
|
|
s.listeners = map[listenKey]*listener{}
|
|
|
|
}
|
|
|
|
if _, ok := s.listeners[key]; ok {
|
|
|
|
s.mu.Unlock()
|
|
|
|
return nil, fmt.Errorf("tsnet: listener already open for %s, %s", network, addr)
|
|
|
|
}
|
|
|
|
s.listeners[key] = ln
|
|
|
|
s.mu.Unlock()
|
|
|
|
return ln, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
type listenKey struct {
|
|
|
|
network string
|
|
|
|
host string
|
|
|
|
port string
|
|
|
|
}
|
|
|
|
|
|
|
|
type listener struct {
|
|
|
|
s *Server
|
|
|
|
key listenKey
|
|
|
|
addr string
|
|
|
|
conn chan net.Conn
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ln *listener) Accept() (net.Conn, error) {
|
|
|
|
c, ok := <-ln.conn
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("tsnet: %w", net.ErrClosed)
|
|
|
|
}
|
|
|
|
return c, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ln *listener) Addr() net.Addr { return addr{ln} }
|
|
|
|
func (ln *listener) Close() error {
|
|
|
|
ln.s.mu.Lock()
|
|
|
|
defer ln.s.mu.Unlock()
|
|
|
|
if v, ok := ln.s.listeners[ln.key]; ok && v == ln {
|
|
|
|
delete(ln.s.listeners, ln.key)
|
|
|
|
close(ln.conn)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
type addr struct{ ln *listener }
|
|
|
|
|
|
|
|
func (a addr) Network() string { return a.ln.key.network }
|
|
|
|
func (a addr) String() string { return a.ln.addr }
|