Merge remote-tracking branch 'origin/hwh33/tsnet-services-support'

Author: mtparet

ipn/ipnlocal/cert.go

@@ -107,6 +107,15 @@ func (b *LocalBackend) GetCertPEM(ctx context.Context, domain string) (*TLSCertK
 // If a cert is expired, or expires sooner than minValidity, it will be renewed
 // synchronously. Otherwise it will be renewed asynchronously.
 func (b *LocalBackend) GetCertPEMWithValidity(ctx context.Context, domain string, minValidity time.Duration) (*TLSCertKeyPair, error) {
+	b.mu.Lock()
+	getCertForTest := b.getCertForTest
+	b.mu.Unlock()
+
+	if getCertForTest != nil {
+		testenv.AssertInTest()
+		return getCertForTest(domain)
+	}
+
 	if !validLookingCertDomain(domain) {
 		return nil, errors.New("invalid domain")
 	}
@@ -303,6 +312,16 @@ func (b *LocalBackend) getCertStore() (certStore, error) {
 	return certFileStore{dir: dir, testRoots: testX509Roots}, nil
 }
 
+// ConfigureCertsForTest sets a certificate retrieval function to be used by
+// this local backend, skipping the usual ACME certificate registration. Should
+// only be used in tests.
+func (b *LocalBackend) ConfigureCertsForTest(getCert func(hostname string) (*TLSCertKeyPair, error)) {
+	testenv.AssertInTest()
+	b.mu.Lock()
+	b.getCertForTest = getCert
+	b.mu.Unlock()
+}
+
 // certFileStore implements certStore by storing the cert & key files in the named directory.
 type certFileStore struct {
 	dir string

ipn/ipnlocal/local.go

@@ -399,6 +399,10 @@ type LocalBackend struct {
 	// hardwareAttested is whether backend should use a hardware-backed key to
 	// bind the node identity to this device.
 	hardwareAttested atomic.Bool
+
+	// getCertForTest is used to retrieve TLS certificates in tests.
+	// See [LocalBackend.ConfigureCertsForTest].
+	getCertForTest func(hostname string) (*TLSCertKeyPair, error)
 }
 
 // SetHardwareAttested enables hardware attestation key signatures in map

ipn/serve.go

@@ -17,6 +17,7 @@ import (
 
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tailcfg"
+	"tailscale.com/types/bools"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/mak"
@@ -433,24 +434,35 @@ func (sc *ServeConfig) SetTCPForwarding(port uint16, fwdAddr string, terminateTL
 	if sc == nil {
 		sc = new(ServeConfig)
 	}
-	tcpPortHandler := &sc.TCP
-	if svcName := tailcfg.AsServiceName(host); svcName != "" {
-		svcConfig, ok := sc.Services[svcName]
-		if !ok {
-			svcConfig = new(ServiceConfig)
-			mak.Set(&sc.Services, svcName, svcConfig)
-		}
-		tcpPortHandler = &svcConfig.TCP
-	}
-
 	handler := &TCPPortHandler{
 		TCPForward:    fwdAddr,
 		ProxyProtocol: proxyProtocol, // can be 0
 	}
 	if terminateTLS {
 		handler.TerminateTLS = host
 	}
-	mak.Set(tcpPortHandler, port, handler)
+	mak.Set(&sc.TCP, port, handler)
+}
+
+// SetTCPForwardingForService sets the fwdAddr (IP:port form) to which to
+// forward connections from the given port on the service. If terminateTLS
+// is true, TLS connections are terminated, with only the FQDN that corresponds
+// to the given service being permitted, before passing them to the fwdAddr.
+func (sc *ServeConfig) SetTCPForwardingForService(port uint16, fwdAddr string, svcName tailcfg.ServiceName, terminateTLS bool, proxyProtocol int, magicDNSSuffix string) {
+	if sc == nil {
+		sc = new(ServeConfig)
+	}
+	svcConfig, ok := sc.Services[svcName]
+	if !ok {
+		svcConfig = new(ServiceConfig)
+		mak.Set(&sc.Services, svcName, svcConfig)
+	}
+	fqdn := svcName.WithoutPrefix() + "." + magicDNSSuffix
+	mak.Set(&svcConfig.TCP, port, &TCPPortHandler{
+		TCPForward:    fwdAddr,
+		ProxyProtocol: proxyProtocol,
+		TerminateTLS:  bools.IfElse(terminateTLS, fqdn, ""),
+	})
 }
 
 // SetFunnel sets the sc.AllowFunnel value for the given host and port.

tsnet/example/tsnet-services/tsnet-services.go

@@ -0,0 +1,60 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// The tsnet-services example demonstrates how to use tsnet with Services.
+// TODO:
+//   - explain that a Service must be defined for the tailent and link to KB on
+//     defining a Service
+//   - recommend using an auth key with associated tags
+//   - recommend an auto-approval rule for service tags
+//
+// To use it, generate an auth key from the Tailscale admin panel and
+// run the demo with the key:
+//
+//	TS_AUTHKEY=<yourkey> go run tsnet-services.go
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+
+	"tailscale.com/tailcfg"
+	"tailscale.com/tsnet"
+)
+
+var (
+	svcName = flag.String("service", "", "the name of your Service, e.g. svc:demo-service")
+)
+
+// TODO: this worked several times, then my host got stuck in 'Partially configured: has-config, config-valid'
+
+func main() {
+	flag.Parse()
+	if *svcName == "" {
+		log.Fatal("a Service name must be provided")
+	}
+
+	const port uint16 = 443
+
+	s := &tsnet.Server{
+		Dir:      "./services-demo-config",
+		Hostname: "tsnet-services-demo",
+	}
+	defer s.Close()
+
+	ln, err := s.ListenService(*svcName, port, tsnet.ServiceOptionTerminateTLS())
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer ln.Close()
+
+	// TODO: provide access to FQDN from listener and use that instead
+	fmt.Printf("Listening on https://%v\n", tailcfg.AsServiceName(*svcName).WithoutPrefix())
+
+	err = http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "<html><body><h1>Hello, tailnet!</h1>")
+	}))
+	log.Fatal(err)
+}

tsnet/tsnet.go

@@ -52,6 +52,7 @@ import (
 	"tailscale.com/net/proxymux"
 	"tailscale.com/net/socks5"
 	"tailscale.com/net/tsdial"
+	"tailscale.com/tailcfg"
 	"tailscale.com/tsd"
 	"tailscale.com/types/bools"
 	"tailscale.com/types/logger"
@@ -158,8 +159,6 @@ type Server struct {
 	// that the control server will allow the node to adopt that tag.
 	AdvertiseTags []string
 
-	getCertForTesting func(*tls.ClientHelloInfo) (*tls.Certificate, error)
-
 	initOnce         sync.Once
 	initErr          error
 	lb               *ipnlocal.LocalBackend
@@ -1101,9 +1100,6 @@ func (s *Server) RegisterFallbackTCPHandler(cb FallbackTCPHandler) func() {
 // It calls GetCertificate on the localClient, passing in the ClientHelloInfo.
 // For testing, if s.getCertForTesting is set, it will call that instead.
 func (s *Server) getCert(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	if s.getCertForTesting != nil {
-		return s.getCertForTesting(hi)
-	}
 	lc, err := s.LocalClient()
 	if err != nil {
 		return nil, err
@@ -1239,6 +1235,189 @@ func (s *Server) ListenFunnel(network, addr string, opts ...FunnelOption) (net.L
 	return tls.NewListener(ln, tlsConfig), nil
 }
 
+// TODO: doc
+type ServiceOption interface {
+	serviceOption()
+}
+
+type serviceOptionTerminateTLS struct{}
+
+func (serviceOptionTerminateTLS) serviceOption() {}
+
+// TODO: doc
+func ServiceOptionTerminateTLS() ServiceOption {
+	return serviceOptionTerminateTLS{}
+}
+
+type serviceOptionPROXYProtocol struct {
+	version int
+}
+
+func (serviceOptionPROXYProtocol) serviceOption() {}
+
+// TODO: doc
+func ServiceOptionPROXYProtocol(version int) ServiceOption {
+	return serviceOptionPROXYProtocol{version}
+}
+
+type serviceOptionAppCapabilities struct {
+	path string
+	caps []string
+}
+
+func (serviceOptionAppCapabilities) serviceOption() {}
+
+// TODO: doc
+func ServiceOptionAppCapabilities(capabilities ...string) ServiceOption {
+	return ServiceOptionAppCapabilitiesForPath("/", capabilities...)
+}
+
+// TODO: doc
+func ServiceOptionAppCapabilitiesForPath(path string, capabilities ...string) ServiceOption {
+	return serviceOptionAppCapabilities{path, capabilities}
+}
+
+type serviceOptionWithHeaders struct{}
+
+func (serviceOptionWithHeaders) serviceOption() {}
+
+// TODO: doc
+func ServiceOptionWithHeaders() ServiceOption {
+	return serviceOptionWithHeaders{}
+}
+
+// ErrUntaggedServiceHost is returned by ListenService when run on a node
+// without any ACL tags. A node must use a tag-based identity to act as a
+// Service host. For more information, see:
+// https://tailscale.com/kb/1552/tailscale-services#prerequisites
+var ErrUntaggedServiceHost = errors.New("service hosts must be tagged nodes")
+
+// TODO: doc
+// TODO: tailcfg.ServiceName?
+func (s *Server) ListenService(name string, port uint16, opts ...ServiceOption) (net.Listener, error) {
+	if err := tailcfg.ServiceName(name).Validate(); err != nil {
+		return nil, err
+	}
+	svcName := name
+
+	// TODO:
+	// - create example for a Service with multiple ports
+	// - support web handlers?
+	//   - at least app capabilities need to work
+	//   - everything else could serve directly or use http.ReverseProxy, right?
+	//     - maybe worth an http.ReverseProxy example?
+	// - support TUN mode
+
+	// Process options.
+	terminateTLS := false
+	proxyProtocol := 0
+	capsMap := map[string][]tailcfg.PeerCapability{} // mount point => caps
+	isHTTP := false
+	for _, o := range opts {
+		switch opt := o.(type) {
+		case serviceOptionTerminateTLS:
+			terminateTLS = true
+		case serviceOptionPROXYProtocol:
+			proxyProtocol = opt.version
+		case serviceOptionWithHeaders:
+			isHTTP = true
+		case serviceOptionAppCapabilities:
+			isHTTP = true
+			caps := make([]tailcfg.PeerCapability, 0, len(opt.caps))
+			for _, c := range opt.caps {
+				caps = append(caps, tailcfg.PeerCapability(c))
+			}
+			capsMap[opt.path] = append(capsMap[opt.path], caps...)
+		default:
+			return nil, fmt.Errorf("unknown opts FunnelOption type %T", o)
+		}
+	}
+
+	ctx := context.Background()
+	_, err := s.Up(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	lc := s.localClient
+
+	st, err := lc.StatusWithoutPeers(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching ACL tags: %w", err)
+	}
+	if st.Self.Tags == nil || st.Self.Tags.Len() == 0 {
+		return nil, ErrUntaggedServiceHost
+	}
+
+	prefs, err := lc.GetPrefs(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching node preferences: %w", err)
+	}
+	if !slices.Contains(prefs.AdvertiseServices, svcName) {
+		// TODO: do we need to undo this edit on error?
+		_, err = lc.EditPrefs(ctx, &ipn.MaskedPrefs{
+			AdvertiseServicesSet: true,
+			Prefs: ipn.Prefs{
+				AdvertiseServices: append(prefs.AdvertiseServices, svcName),
+			},
+		})
+		if err != nil {
+			return nil, fmt.Errorf("updating advertised Services: %w", err)
+		}
+	}
+
+	srvConfig, err := lc.GetServeConfig(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching node serve config: %w", err)
+	}
+	if srvConfig == nil {
+		srvConfig = new(ipn.ServeConfig)
+	}
+
+	// Start listening on a TCP socket.
+	ln, err := net.Listen("tcp", "localhost:0")
+	if err != nil {
+		return nil, fmt.Errorf("starting local listener: %w", err)
+	}
+
+	if isHTTP {
+		useTLS := false // TODO: set correctly
+		mds := st.CurrentTailnet.MagicDNSSuffix
+		setHandler := func(h ipn.HTTPHandler, path string) {
+			// TODO: do we need to add the path to the end of the proxy value?
+			h.Proxy = ln.Addr().String()
+			srvConfig.SetWebHandler(&h, svcName, port, path, useTLS, mds)
+		}
+		// Set a web handler for every mount point in the caps map. If we don't
+		// end up with a root handler after that, we need to set one.
+		haveRootHandler := false
+		for path, caps := range capsMap {
+			if path == "/" {
+				haveRootHandler = true
+			}
+			setHandler(ipn.HTTPHandler{AcceptAppCaps: caps}, path)
+		}
+		if !haveRootHandler {
+			setHandler(ipn.HTTPHandler{}, "/")
+		}
+	} else {
+		// Forward all connections from service-hostname:port to our socket.
+		srvConfig.SetTCPForwardingForService(
+			port, ln.Addr().String(), tailcfg.ServiceName(svcName),
+			terminateTLS, proxyProtocol, st.CurrentTailnet.MagicDNSSuffix)
+	}
+
+	if err := lc.SetServeConfig(ctx, srvConfig); err != nil {
+		ln.Close()
+		return nil, err
+	}
+
+	// TODO: wrap returned listener such that Close stops advertising the
+	// Service (should update prefs, serve config, etc.)
+
+	return ln, nil
+}
+
 type listenOn string
 
 const (