TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-30 12:42:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/tailscale/cli: add --posture-checking to tailscale up

Browse Source 
This will prevent `tailscale up` from resetting the posture checking
client pref.

Fixes #12154

Signed-off-by: Anton Tolchanov <anton@tailscale.com>
This commit is contained in:
Anton Tolchanov 2025-01-14 12:12:05 +00:00 committed by Anton Tolchanov
parent 64ab0ddff1
commit e4385f1c02
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
cmd/tailscale/cli/cli_test.go
View File

@ -601,6 +601,19 @@ func TestCheckForAccidentalSettingReverts(t *testing.T) {
goos: "linux", goos: "linux",
want: "", want: "",
}, },
{
name: "losing_posture_checking",
flags: []string{"--accept-dns"},
curPrefs: &ipn.Prefs{
ControlURL: ipn.DefaultControlURL,
WantRunning: false,
CorpDNS: true,
PostureChecking: true,
NetfilterMode: preftype.NetfilterOn,
NoStatefulFiltering: opt.NewBool(true),
},
want: accidentalUpPrefix + " --accept-dns --posture-checking",
},
} }
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {
@ -1045,6 +1058,7 @@ func TestUpdatePrefs(t *testing.T) {
NoSNATSet: true, NoSNATSet: true,
NoStatefulFilteringSet: true, NoStatefulFilteringSet: true,
OperatorUserSet: true, OperatorUserSet: true,
PostureCheckingSet: true,
RouteAllSet: true, RouteAllSet: true,
RunSSHSet: true, RunSSHSet: true,
ShieldsUpSet: true, ShieldsUpSet: true,

5
cmd/tailscale/cli/up.go
View File

@ -116,6 +116,7 @@ func newUpFlagSet(goos string, upArgs *upArgsT, cmd string) *flag.FlagSet {
upf.StringVar(&upArgs.advertiseRoutes, "advertise-routes", "", "routes to advertise to other nodes (comma-separated, e.g. \"10.0.0.0/8,192.168.0.0/24\") or empty string to not advertise routes") upf.StringVar(&upArgs.advertiseRoutes, "advertise-routes", "", "routes to advertise to other nodes (comma-separated, e.g. \"10.0.0.0/8,192.168.0.0/24\") or empty string to not advertise routes")
upf.BoolVar(&upArgs.advertiseConnector, "advertise-connector", false, "advertise this node as an app connector") upf.BoolVar(&upArgs.advertiseConnector, "advertise-connector", false, "advertise this node as an app connector")
upf.BoolVar(&upArgs.advertiseDefaultRoute, "advertise-exit-node", false, "offer to be an exit node for internet traffic for the tailnet") upf.BoolVar(&upArgs.advertiseDefaultRoute, "advertise-exit-node", false, "offer to be an exit node for internet traffic for the tailnet")
upf.BoolVar(&upArgs.postureChecking, "posture-checking", false, hidden+"allow management plane to gather device posture information")
if safesocket.GOOSUsesPeerCreds(goos) { if safesocket.GOOSUsesPeerCreds(goos) {
upf.StringVar(&upArgs.opUser, "operator", "", "Unix username to allow to operate on tailscaled without sudo") upf.StringVar(&upArgs.opUser, "operator", "", "Unix username to allow to operate on tailscaled without sudo")
@ -194,6 +195,7 @@ type upArgsT struct {
timeout time.Duration timeout time.Duration
acceptedRisks string acceptedRisks string
profileName string profileName string
postureChecking bool
} }
func (a upArgsT) getAuthKey() (string, error) { func (a upArgsT) getAuthKey() (string, error) {
@ -304,6 +306,7 @@ func prefsFromUpArgs(upArgs upArgsT, warnf logger.Logf, st *ipnstate.Status, goo
prefs.OperatorUser = upArgs.opUser prefs.OperatorUser = upArgs.opUser
prefs.ProfileName = upArgs.profileName prefs.ProfileName = upArgs.profileName
prefs.AppConnector.Advertise = upArgs.advertiseConnector prefs.AppConnector.Advertise = upArgs.advertiseConnector
prefs.PostureChecking = upArgs.postureChecking
if goos == "linux" { if goos == "linux" {
prefs.NoSNAT = !upArgs.snat prefs.NoSNAT = !upArgs.snat
@ -1053,6 +1056,8 @@ func prefsToFlags(env upCheckEnv, prefs *ipn.Prefs) (flagVal map[string]any) {
set(prefs.NetfilterMode.String()) set(prefs.NetfilterMode.String())
case "unattended": case "unattended":
set(prefs.ForceDaemon) set(prefs.ForceDaemon)
case "posture-checking":
set(prefs.PostureChecking)
} }
}) })
return ret return ret