summaryrefslogtreecommitdiffhomepage
path: root/control/controlhttp
AgeCommit message (Collapse)AuthorFilesLines
2022-09-23tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan ↵Andrew Dunham3-9/+464
field (#5648) * tailcfg, control/controlhttp, control/controlclient: add ControlDialPlan field This field allows the control server to provide explicit information about how to connect to it; useful if the client's link status can change after the initial connection, or if the DNS settings pushed by the control server break future connections. Change-Id: I720afe6289ec27d40a41b3dcb310ec45bd7e5f3e Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-16control/controlhttp: move Dial options into options struct (#5661)Andrew Dunham4-54/+123
This turns 'dialParams' into something more like net.Dialer, where configuration fields are public on the struct. Split out of #5648 Change-Id: I0c56fd151dc5489c3c94fb40d18fd639e06473bc Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-15cmd/derper, control/controlhttp: disable WebSocket compressionMihai Parparita1-0/+6
The data that we send over WebSockets is encrypted and thus not compressible. Additionally, Safari has a broken implementation of compression (see nhooyr/websocket#218) that makes enabling it actively harmful. Fixes tailscale/corp#6943 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-08-15cmd/tailscale/cli: fix build breakMaisem Ali1-8/+3
Accidental break from 64d482ff482b6a616d7f24f939dbc5093d93909b. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-15Allow any port for HTTPS when using Noise over TLSJuan Font Alonso1-9/+5
Signed-off-by: Juan Font Alonso <juanfontalonso@gmail.com>
2022-06-08control/controlhttp: use secure WebSockets protocol by defaultMihai Parparita1-4/+10
Forcing the insecure protocol (and perserving the port number) is only desired for localhost testing, in prod we need to use wss:// to avoid mixed-content errors. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-07net/wsconn: remove homegrown wrapper for turning a websocket.Conn into a ↵Mihai Parparita2-4/+2
net.Conn The one from the nhooyr/websocket package seems to work equally well. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-06-02control/controlhttp: allow client and server to communicate over WebSocketsMihai Parparita4-15/+123
We can't do Noise-over-HTTP in Wasm/JS (because we don't have bidirectional communication), but we should be able to do it over WebSockets. Reuses derp WebSocket support that allows us to turn a WebSocket connection into a net.Conn. Updates #3157 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2022-04-28control/controlhttp: don't assume port 80 upgrade response will workBrad Fitzpatrick2-48/+106
Just because we get an HTTP upgrade response over port 80, don't assume we'll be able to do bi-di Noise over it. There might be a MITM corp proxy or anti-virus/firewall interfering. Do a bit more work to validate the connection before proceeding to give up on the TLS port 443 dial. Updates #4557 (probably fixes) Change-Id: I0e1bcc195af21ad3d360ffe79daead730dfd86f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-27net/tsdial: add SystemDial as a wrapper on netns.DialMaisem Ali2-6/+7
The connections returned from SystemDial are automatically closed when there is a major link change. Also plumb through the dialer to the noise client so that connections are auto-reset when moving from cellular to WiFi etc. Updates #3363 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-27control/controlhttp: start port 443 fallback sooner if 80's stuckBrad Fitzpatrick1-31/+82
Fixes #4544 Change-Id: I39877e71915ad48c6668351c45cd8e33e2f5dbae Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-07control/controlbase: don't enforce a max protocol version at handshake time.David Anderson2-3/+3
Doing so makes development unpleasant, because we have to first break the client by bumping to a version the control server rejects, then upgrade the control server to make it accept the new version. This strict rejection at handshake time is only necessary if we want to blocklist some vulnerable protocol versions in the future. So, switch to a default-permissive stance: until we have such a version that we have to eagerly block early, we'll accept whatever version the client presents, and leave it to the user of controlbase.Conn to make decisions based on that version. Noise still enforces that the client and server *agree* on what protocol version is being used, and the control server still has the option to finish the handshake and then hang up with an in-noise error, rather than abort at the handshake level. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-04-07control/controlbase: make the protocol version number selectable.David Anderson3-6/+10
This is so that we can plumb our client capability version through the protocol as the Noise version. The capability version increments more frequently than strictly required (the Noise version only needs to change when cryptographically-significant changes are made to the protocol, whereas the capability version also indicates changes in non-cryptographically-significant parts of the protocol), but this gives us a safe pre-auth way to determine if the client supports future protocol features, while still relying on Noise's strong assurance that the client and server have agreed on the same version. Currently, the server executes the same protocol regardless of the version number, and just presents the version to the caller so they can do capability-based things in the upper RPC protocol. In future, we may add a ratchet to disallow obsolete protocols, or vary the Noise handshake behavior based on requested version. Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
2022-03-24net/netutil: move some net utils from control/controlhttp to netutilBrad Fitzpatrick2-42/+4
In prep for reuse elsewhere. Change-Id: I1b804edf76ac66b9108e6f434e77eab7a7472d69 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-26controlhttp: add some docs, change Dial's path from /switch to /ts2021Brad Fitzpatrick1-4/+15
When I deployed server-side changes, I put the upgrade handler at /ts2021 instead of /switch. We could move the server to /switch, but ts2021 seems more specific and better, but I don't feel strongly. Updates #3488 Change-Id: Ifbf8ea60a815fd2fa1bfbe1b7af1ac2a27218354 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-01-17control/controlhttp: package to get a controlbase.Conn over HTTP(S).David Anderson3-0/+735
Updates #3488 Signed-off-by: David Anderson <danderson@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.