summaryrefslogtreecommitdiffhomepage
path: root/ssh/tailssh/tailssh_test.go
AgeCommit message (Collapse)AuthorFilesLines
2023-06-21ssh/tailssh: fix double race condition with non-pty command (#8405)Joe Tsai1-0/+14
There are two race conditions in output handling. The first race condition is due to a misuse of exec.Cmd.StdoutPipe. The documentation explicitly forbids concurrent use of StdoutPipe with exec.Cmd.Wait (see golang/go#60908) because Wait will close both sides of the pipe once the process ends without any guarantees that all data has been read from the pipe. To fix this, we allocate the os.Pipes ourselves and manage cleanup ourselves when the process has ended. The second race condition is because sshSession.run waits upon exec.Cmd to finish and then immediately proceeds to call ss.Exit, which will close all output streams going to the SSH client. This may interrupt any asynchronous io.Copy still copying data. To fix this, we close the write-side of the os.Pipes after the process has finished (and before calling ss.Exit) and synchronously wait for the io.Copy routines to finish. Fixes #7601 Signed-off-by: Joe Tsai <joetsai@digital-static.net> Co-authored-by: Maisem Ali <maisem@tailscale.com>
2023-05-21ssh/tailssh: fix regression after LDAP supportBrad Fitzpatrick1-1/+1
58ab66ec51f1963fbee302c75ad0017d81d37884 added LDAP support for #4945 by shelling out to getdent. It was supposed to fall back to the old method when getdent wasn't found, but some variable name confusion (uid vs username) meant the old path wasn't calling the right lookup function (user.LookupId instead of user.Lookup). Which meant that changed probably also broke FreeBSD and macOS SSH support in addition to the reported OpenWRT regression. The gokrazy support didn't look right either. Fixes #8180 Change-Id: I273bbe96fe98b2517fbf0335fd476b483c051554 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-08ssh/tailssh: support LDAP users for Tailscale SSHBrad Fitzpatrick1-1/+12
Fixes #4945 Change-Id: Ie013cb47684cb87928a44f92c66352310bfe53f1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-05ssh/tailssh: send ssh event notifications on recording failuresCharlotte Brandhorst-Satzkorn1-0/+5
This change sends an SSHEventNotificationRequest over noise when a SSH session is set to fail closed and the session is unable to start because a recorder is not available or a session is terminated because connection to the recorder is ended. Each of these scenarios have their own event type. Updates tailscale/corp#9967 Signed-off-by: Charlotte Brandhorst-Satzkorn <charlotte@tailscale.com>
2023-05-04tsd: add package with System type to unify subsystem init, discoveryBrad Fitzpatrick1-5/+6
This is part of an effort to clean up tailscaled initialization between tailscaled, tailscaled Windows service, tsnet, and the mac GUI. Updates #8036 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-04-22ssh/tailssh: handle dialing multiple recorders and failing openMaisem Ali1-7/+110
This adds support to try dialing out to multiple recorders each with a 5s timeout and an overall 30s timeout. It also starts respecting the actions `OnRecordingFailure` field if set, if it is not set it fails open. Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-04-05ssh/tailssh: handle output matching better in tests (#7799)Maisem Ali1-2/+14
2023-03-25ssh/tailssh: add tests for recording failureMaisem Ali1-14/+114
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-24ssh/tailssh: add session recording test for non-pty sessionsMaisem Ali1-2/+96
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23ssh/tailssh: handle session recording when running in userspace modeMaisem Ali1-0/+4
Previously it would dial out using the http.DefaultClient, however that doesn't work when tailscaled is running in userspace mode (e.g. when testing). Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23ssh/tailssh: enable recording of non-pty sessionsMaisem Ali1-1/+2
Updates tailscale/corp#9967 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-03-23all: pass log IDs as the proper type rather than stringsWill Norris1-1/+2
This change focuses on the backend log ID, which is the mostly commonly used in the client. Tests which don't seem to make use of the log ID just use the zero value. Signed-off-by: Will Norris <will@tailscale.com>
2023-02-01all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our forkBrad Fitzpatrick1-2/+1
Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-01-30ipn/ipnlocal: drop not required StateKey parameterMaisem Ali1-1/+1
This is #cleanup now that #7121 is merged. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-01-30net/memnet: rename from net/nettestMaisem Ali1-2/+2
This is just #cleanup to resolve a TODO Also add a package doc. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2023-01-27all: update copyright and license headersWill Norris1-3/+2
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2022-12-15ssh/tailssh: add envknob for default PATHBrad Fitzpatrick1-1/+21
As backup plan, just in case the earlier fix's logic wasn't correct and we want to experiment in the field or have users have a quicker fix. Updates #5285 Change-Id: I7447466374d11f8f609de6dfbc4d9a944770826d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-14ssh/tailssh: set default Tailscale SSH $PATH for non-interactive commandsBrad Fitzpatrick1-0/+41
Fixes #5285 Co-authored-by: Andrew Dunham <andrew@tailscale.com> Change-Id: Ic7e967bf6a53b056cac5f21dd39565d9c31563af Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-11-11ipn/ipnlocal: add support for multiple user profilesMaisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-11-04all: remove old +build tagsBrad Fitzpatrick1-1/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-11ssh/tailssh: add password-forcing workaround for buggy SSH clientsBrad Fitzpatrick1-5/+32
If the username includes a suffix of +password, then we accept password auth and just let them in like it were no auth. This exists purely for SSH clients that get confused by seeing success to their initial auth type "none". Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I616d4c64d042449fb164f615012f3bae246e91ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-10-09ssh/tailssh: add support for sending multiple bannersMaisem Ali1-15/+24
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-10-09ssh/tailssh: add TestSSHAuthFlowMaisem Ali1-3/+257
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-07-25all: use various net/netip parse funcs directlyBrad Fitzpatrick1-4/+4
Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick1-1/+1
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-21ssh/tailssh: handle not-authenticated-yet connections in matchRuleMaisem Ali1-0/+14
Also make more fields in conn.info thread safe, there was previously a data race here. Fixes #5110 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-06-27ssh/tailssh: always use current time for policy evaluationMaisem Ali1-1/+0
Whenever the SSH policy changes we revaluate all open connections to make sure they still have access. This check was using the wrong timestamp and would match against expired policies, however this really isn't a problem today as we don't have policy that would be impacted by this check. Fixing it for future use. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-06-27ssh/tailssh: allow multiple sessions on the same connMaisem Ali1-1/+2
Fixes #4920 Fixes tailscale/corp#5633 Updates #4479 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-21ssh/tailssh: avoid user ssh configuration in testsJames Tucker1-0/+2
Signed-off-by: James Tucker <james@tailscale.com>
2022-04-21ssh/tailssh: filter accepted environment variablesBrad Fitzpatrick1-0/+19
Noted by @danderson Updates #3802 Change-Id: Iac70717ed57f11726209ac1ea93ddc6696605f94 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: send banner messages during auth, move more to connMaisem Ali1-14/+19
(VSCode Live Share between Brad & Maisem!) Updates #3802 Change-Id: Id8edca4481b0811debfdf56d4ccb1a46f71dd6d3 Co-Authored-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-20ssh/tailssh: support expansions in public key fetch URL tooBrad Fitzpatrick1-0/+20
Updates #3802 Change-Id: I5aa98bdab14fd1c1c00ba63b93f8d7e670f72437 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-20ssh/tailssh: terminate ssh auth early if no policy can matchMaisem Ali1-5/+8
Also bump github.com/tailscale/golang-x-crypto/ssh Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-04-18ssh/tailssh: cache public keys fetched from URLsBrad Fitzpatrick1-0/+67
Updates #3802 Change-Id: I96715bae02bce6ea19f16b1736d1bbcd7bcf3534 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-15tailcfg, ssh/tailssh: optionally support SSH public keys in wire policyBrad Fitzpatrick1-1/+4
And clean up logging. Updates #3802 Change-Id: I756dc2d579a16757537142283d791f1d0319f4f0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-26tempfork: temporarily fork gliderlabs/ssh and x/crypto/sshBrad Fitzpatrick1-1/+1
While we rearrange/upstream things. gliderlabs/ssh is forked into tempfork from our prior fork at https://github.com/tailscale/ssh/commit/be8b7add4057ef5a8e458b42331a7633c06d026a x/crypto/ssh OTOH is forked at https://github.com/tailscale/golang-x-crypto because it was gnarlier to vendor with various internal packages, etc. Its git history shows where it starts (2c7772ba30643b7a2026cbea938420dce7c6384d). Updates #3802 Change-Id: I546e5cdf831cfc030a6c42557c0ad2c58766c65f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-22ssh/tailssh: support placeholders in SSHAction.HoldAndDelegate URLBrad Fitzpatrick1-1/+2
Updates #3802 Change-Id: I60f9827409d14fd4f4824d102ba11db49bf0d365 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-21tailcfg, ssh/tailssh: make SSHUser value '=' map ssh-user to same local-userBrad Fitzpatrick1-0/+12
Updates #3802 Change-Id: Icde60d4150ca15c25d615a4effb3d3c236f020a8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-18all: use cibuild.OnJosh Bleecher Snyder1-6/+3
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2022-03-18ssh/tailssh_test: skip TestSSH/stdin in CIMaisem Ali1-0/+5
Updates #4051 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-17ssh/tailssh_test: Skip the env test in CIMaisem Ali1-3/+5
Updates #4051 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-14ssh/tailssh: add a new sshSession type to clean up existing+future codeBrad Fitzpatrick1-4/+2
Updates #3802 Change-Id: I7054dca387f5e5aee1185937ecf41b77a5a07f1a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Co-authored-by: Maisem Ali <maisem@tailscale.com>
2022-03-12go.mod: move from github.com/gliderlabs/ssh to github.com/tailscale/sshMaisem Ali1-1/+1
Updates #4146 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-09ssh/tailssh: handle local port forwardingMaisem Ali1-1/+4
Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-08ssh/tailssh: create login sessions for new connectionsMaisem Ali1-8/+10
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-01ssh/tailssh: skip flaky test on CI for nowBrad Fitzpatrick1-0/+3
Updates #4051 Change-Id: I94f2165dd248eba9ca3f782c907a13bd6dde4a5e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-28ipn/store: add common package for instantiating ipn.StateStoresMaisem Ali1-2/+2
Also move KubeStore and MemStore into their own package. RELNOTE: tsnet now supports providing a custom ipn.StateStore. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-02-24ssh/tailssh: add more SSH tests, blend in env from ssh sessionBrad Fitzpatrick1-7/+77
Updates #3802 Change-Id: I568c661cacbb0524afcd8be9577457ddba611f19 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-24ssh/tailssh: add start of real ssh testsBrad Fitzpatrick1-0/+85
Updates #3802 Change-Id: I9aea4250062d3a06ca7a5e71a81d31c27a988615 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-02-24ssh: make it build on darwinBrad Fitzpatrick1-2/+2
For local dev testing initially. Product-wise, it'll probably only be workable on the two unsandboxed builds. Updates #3802 Change-Id: Ic352f966e7fb29aff897217d79b383131bf3f92b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.