From 3afebbbc474ab8516b9933866ee97508c8330800 Mon Sep 17 00:00:00 2001 From: Anton Tolchanov Date: Fri, 19 Apr 2024 13:43:07 +0100 Subject: [PATCH] ipn/ipnlocal: always stop the engine on auth when key has expired If seamless key renewal is enabled, we typically do not stop the engine (deconfigure networking). However, if the node key has expired there is no point in keeping the connection up, and it might actually prevent key renewal if auth relies on endpoints routed via app connectors. Fixes tailscale/corp#5800 Signed-off-by: Anton Tolchanov --- ipn/ipnlocal/local.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go index d783fa72f..5a6f6bc84 100644 --- a/ipn/ipnlocal/local.go +++ b/ipn/ipnlocal/local.go @@ -2436,9 +2436,12 @@ func (b *LocalBackend) popBrowserAuthNow() { b.authURL = "" // but NOT clearing authURLSticky b.mu.Unlock() - b.logf("popBrowserAuthNow: url=%v", url != "") + b.logf("popBrowserAuthNow: url=%v, key-expired=%v, seamless-key-renewal=%v", url != "", b.keyExpired, b.seamlessRenewalEnabled()) - if !b.seamlessRenewalEnabled() { + // Deconfigure the local network data plane if: + // - seamless key renewal is not enabled; + // - key is expired (in which case tailnet connectivity is down anyway). + if !b.seamlessRenewalEnabled() || b.keyExpired { b.blockEngineUpdates(true) b.stopEngineAndWait() }