TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-18 20:51:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

ssh/tailssh: add ability to force V2 behavior using new feature flag

Browse Source 
Introduces ssh-behavior-v2 node attribute to override ssh-behavior-v1.

Updates #11854

Signed-off-by: Percy Wegmann <percy@tailscale.com>
This commit is contained in:
Percy Wegmann 2024-08-06 08:00:05 -05:00 committed by Percy Wegmann
parent a584d04f8a
commit ecc451501c
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ssh/tailssh/incubator.go
View File

@ -129,7 +129,8 @@ func (ss *sshSession) newIncubatorCommand(logf logger.Logf) (cmd *exec.Cmd, err
incubatorArgs = append(incubatorArgs, "--is-selinux-enforcing") incubatorArgs = append(incubatorArgs, "--is-selinux-enforcing")
} }
forceV1Behavior := ss.conn.srv.lb.NetMap().HasCap(tailcfg.NodeAttrSSHBehaviorV1) nm := ss.conn.srv.lb.NetMap()
forceV1Behavior := nm.HasCap(tailcfg.NodeAttrSSHBehaviorV1) && !nm.HasCap(tailcfg.NodeAttrSSHBehaviorV2)
if forceV1Behavior { if forceV1Behavior {
incubatorArgs = append(incubatorArgs, "--force-v1-behavior") incubatorArgs = append(incubatorArgs, "--force-v1-behavior")
} }

7
tailcfg/tailcfg.go
View File

@ -2307,6 +2307,13 @@ const (
// Added 2024-05-29 in Tailscale version 1.68. // Added 2024-05-29 in Tailscale version 1.68.
NodeAttrSSHBehaviorV1 NodeCapability = "ssh-behavior-v1" NodeAttrSSHBehaviorV1 NodeCapability = "ssh-behavior-v1"
// NodeAttrSSHBehaviorV2 forces SSH to use the V2 behavior (use su, run SFTP in child process).
// This overrides NodeAttrSSHBehaviorV1 if set.
// See forceV1Behavior in ssh/tailssh/incubator.go for distinction between
// V1 and V2 behavior.
// Added 2024-08-06 in Tailscale version 1.72.
NodeAttrSSHBehaviorV2 NodeCapability = "ssh-behavior-v2"
// NodeAttrDisableSplitDNSWhenNoCustomResolvers indicates that the node's // NodeAttrDisableSplitDNSWhenNoCustomResolvers indicates that the node's
// DNS manager should not adopt a split DNS configuration even though the // DNS manager should not adopt a split DNS configuration even though the
// Config of the resolver only contains routes that do not specify custom // Config of the resolver only contains routes that do not specify custom