From 31e6bdbc826c230bbbc3de9ab23841320519932f Mon Sep 17 00:00:00 2001 From: Anton Tolchanov Date: Fri, 19 Apr 2024 13:43:07 +0100 Subject: [PATCH] ipn/ipnlocal: always stop the engine on auth when key has expired If seamless key renewal is enabled, we typically do not stop the engine (deconfigure networking). However, if the node key has expired there is no point in keeping the connection up, and it might actually prevent key renewal if auth relies on endpoints routed via app connectors. Fixes tailscale/corp#5800 Signed-off-by: Anton Tolchanov --- ipn/ipnlocal/local.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go index 62e8c7905..6a6036031 100644 --- a/ipn/ipnlocal/local.go +++ b/ipn/ipnlocal/local.go @@ -2440,9 +2440,12 @@ func (b *LocalBackend) popBrowserAuthNow() { b.authURL = "" // but NOT clearing authURLSticky b.mu.Unlock() - b.logf("popBrowserAuthNow: url=%v", url != "") + b.logf("popBrowserAuthNow: url=%v, key-expired=%v, seamless-key-renewal=%v", url != "", b.keyExpired, b.seamlessRenewalEnabled()) - if !b.seamlessRenewalEnabled() { + // Deconfigure the local network data plane if: + // - seamless key renewal is not enabled; + // - key is expired (in which case tailnet connectivity is down anyway). + if !b.seamlessRenewalEnabled() || b.keyExpired { b.blockEngineUpdates(true) b.stopEngineAndWait() }