TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-05 15:55:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/ipnlocal: support web TLS ports other than 443

Browse Source 
Updates tailscale/corp#7515

Change-Id: I87df50b1bc92efd1d8c538c2ad4f1222361e4d6b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick 2022-11-09 21:04:05 -08:00 committed by Brad Fitzpatrick
parent 4797bacb7c
commit 1a94c309ea
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
ipn/ipnlocal/serve.go
View File

@ -8,6 +8,7 @@ import (
"context" "context"
"crypto/tls" "crypto/tls"
"errors" "errors"
"fmt"
"io" "io"
"net" "net"
"net/http" "net/http"
@ -19,6 +20,14 @@ import (
"tailscale.com/net/netutil" "tailscale.com/net/netutil"
) )
// serveHTTPContextKey is the context.Value key for a *serveHTTPContext.
type serveHTTPContextKey struct{}
type serveHTTPContext struct {
SrcAddr netip.AddrPort
DestPort uint16
}
func (b *LocalBackend) HandleInterceptedTCPConn(dport uint16, srcAddr netip.AddrPort, getConn func() (net.Conn, bool), sendRST func()) { func (b *LocalBackend) HandleInterceptedTCPConn(dport uint16, srcAddr netip.AddrPort, getConn func() (net.Conn, bool), sendRST func()) {
b.mu.Lock() b.mu.Lock()
sc := b.serveConfig sc := b.serveConfig
@ -43,13 +52,17 @@ func (b *LocalBackend) HandleInterceptedTCPConn(dport uint16, srcAddr netip.Addr
b.logf("localbackend: getConn didn't complete from %v to port %v", srcAddr, dport) b.logf("localbackend: getConn didn't complete from %v to port %v", srcAddr, dport)
return return
} }
// TODO(bradfitz): look up how; sniff SNI if ambiguous
hs := &http.Server{ hs := &http.Server{
TLSConfig: &tls.Config{ TLSConfig: &tls.Config{
GetCertificate: b.getTLSServeCert, GetCertificate: b.getTLSServeCert,
}, },
Handler: http.HandlerFunc(b.serveWebHandler), Handler: http.HandlerFunc(b.serveWebHandler),
BaseContext: func(_ net.Listener) context.Context {
return context.WithValue(context.Background(), serveHTTPContextKey{}, &serveHTTPContext{
SrcAddr: srcAddr,
DestPort: dport,
})
},
} }
hs.ServeTLS(netutil.NewOneConnListener(conn, nil), "", "") hs.ServeTLS(netutil.NewOneConnListener(conn, nil), "", "")
return return
@ -105,9 +118,13 @@ func (b *LocalBackend) getServeHandler(r *http.Request) (_ ipn.HTTPHandlerView,
return z, false return z, false
} }
sctx, ok := r.Context().Value(serveHTTPContextKey{}).(*serveHTTPContext)
if !ok {
b.logf("[unexpected] localbackend: no serveHTTPContext in request")
return z, false
}
sni := r.TLS.ServerName sni := r.TLS.ServerName
port := "443" // TODO(bradfitz): fix key := ipn.HostPort(fmt.Sprintf("%s:%v", sni, sctx.DestPort))
key := ipn.HostPort(net.JoinHostPort(sni, port))
b.mu.Lock() b.mu.Lock()
defer b.mu.Unlock() defer b.mu.Unlock()