cmd/tailscaled: make the outbound HTTP/SOCKS5 proxy modular

Updates #12614

Change-Id: Icba6f1c0838dce6ee13aa2dc662fb551813262e4
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/tailscaled/deps_test.go

@@ -135,3 +135,16 @@ func TestOmitOAuthKey(t *testing.T) {
 		},
 	}.Check(t)
 }
+
+func TestOmitOutboundProxy(t *testing.T) {
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		Tags:   "ts_omit_outboundproxy,ts_include_cli",
+		OnDep: func(dep string) {
+			if strings.Contains(dep, "socks5") || strings.Contains(dep, "proxymux") {
+				t.Errorf("unexpected dep with ts_omit_outboundproxy: %q", dep)
+			}
+		},
+	}.Check(t)
+}

cmd/tailscaled/proxy.go

@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
-//go:build go1.19
+//go:build !ts_omit_outboundproxy
 
 // HTTP proxy code
 
@@ -9,13 +9,105 @@ package main
 
 import (
 	"context"
+	"flag"
 	"io"
+	"log"
 	"net"
 	"net/http"
 	"net/http/httputil"
 	"strings"
+
+	"tailscale.com/net/proxymux"
+	"tailscale.com/net/socks5"
+	"tailscale.com/net/tsdial"
+	"tailscale.com/net/tshttpproxy"
+	"tailscale.com/types/logger"
 )
 
+func init() {
+	hookRegisterOutboundProxyFlags.Set(registerOutboundProxyFlags)
+	hookOutboundProxyListen.Set(outboundProxyListen)
+}
+
+func registerOutboundProxyFlags() {
+	flag.StringVar(&args.socksAddr, "socks5-server", "", `optional [ip]:port to run a SOCK5 server (e.g. "localhost:1080")`)
+	flag.StringVar(&args.httpProxyAddr, "outbound-http-proxy-listen", "", `optional [ip]:port to run an outbound HTTP proxy (e.g. "localhost:8080")`)
+}
+
+// outboundProxyListen creates listeners for local SOCKS and HTTP proxies, if
+// the respective addresses are not empty. args.socksAddr and args.httpProxyAddr
+// can be the same, in which case the SOCKS5 Listener will receive connections
+// that look like they're speaking SOCKS and httpListener will receive
+// everything else.
+//
+// socksListener and httpListener can be nil, if their respective addrs are
+// empty.
+//
+// The returned func closes over those two (possibly nil) listeners and
+// starts the respective servers on the listener when called.
+func outboundProxyListen() proxyStartFunc {
+	socksAddr, httpAddr := args.socksAddr, args.httpProxyAddr
+
+	if socksAddr == httpAddr && socksAddr != "" && !strings.HasSuffix(socksAddr, ":0") {
+		ln, err := net.Listen("tcp", socksAddr)
+		if err != nil {
+			log.Fatalf("proxy listener: %v", err)
+		}
+		return mkProxyStartFunc(proxymux.SplitSOCKSAndHTTP(ln))
+	}
+
+	var socksListener, httpListener net.Listener
+	var err error
+	if socksAddr != "" {
+		socksListener, err = net.Listen("tcp", socksAddr)
+		if err != nil {
+			log.Fatalf("SOCKS5 listener: %v", err)
+		}
+		if strings.HasSuffix(socksAddr, ":0") {
+			// Log kernel-selected port number so integration tests
+			// can find it portably.
+			log.Printf("SOCKS5 listening on %v", socksListener.Addr())
+		}
+	}
+	if httpAddr != "" {
+		httpListener, err = net.Listen("tcp", httpAddr)
+		if err != nil {
+			log.Fatalf("HTTP proxy listener: %v", err)
+		}
+		if strings.HasSuffix(httpAddr, ":0") {
+			// Log kernel-selected port number so integration tests
+			// can find it portably.
+			log.Printf("HTTP proxy listening on %v", httpListener.Addr())
+		}
+	}
+
+	return mkProxyStartFunc(socksListener, httpListener)
+}
+
+func mkProxyStartFunc(socksListener, httpListener net.Listener) proxyStartFunc {
+	return func(logf logger.Logf, dialer *tsdial.Dialer) {
+		var addrs []string
+		if httpListener != nil {
+			hs := &http.Server{Handler: httpProxyHandler(dialer.UserDial)}
+			go func() {
+				log.Fatalf("HTTP proxy exited: %v", hs.Serve(httpListener))
+			}()
+			addrs = append(addrs, httpListener.Addr().String())
+		}
+		if socksListener != nil {
+			ss := &socks5.Server{
+				Logf:   logger.WithPrefix(logf, "socks5: "),
+				Dialer: dialer.UserDial,
+			}
+			go func() {
+				log.Fatalf("SOCKS5 server exited: %v", ss.Serve(socksListener))
+			}()
+			addrs = append(addrs, socksListener.Addr().String())
+		}
+		tshttpproxy.SetSelfProxy(addrs...)
+	}
+}
+
 // httpProxyHandler returns an HTTP proxy http.Handler using the
 // provided backend dialer.
 func httpProxyHandler(dialer func(ctx context.Context, netw, addr string) (net.Conn, error)) http.Handler {

cmd/tailscaled/tailscaled.go

@@ -48,10 +48,7 @@ import (
 	"tailscale.com/net/dnsfallback"
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/netns"
-	"tailscale.com/net/proxymux"
-	"tailscale.com/net/socks5"
 	"tailscale.com/net/tsdial"
-	"tailscale.com/net/tshttpproxy"
 	"tailscale.com/net/tstun"
 	"tailscale.com/paths"
 	"tailscale.com/safesocket"
@@ -176,6 +173,17 @@ func shouldRunCLI() bool {
 	return false
 }
 
+// Outbound Proxy hooks
+var (
+	hookRegisterOutboundProxyFlags feature.Hook[func()]
+	hookOutboundProxyListen        feature.Hook[func() proxyStartFunc]
+)
+
+// proxyStartFunc is the type of the function returned by
+// outboundProxyListen, to start the servers on the Listeners
+// started by hookOutboundProxyListen.
+type proxyStartFunc = func(logf logger.Logf, dialer *tsdial.Dialer)
+
 func main() {
 	envknob.PanicIfAnyEnvCheckedInInit()
 	if shouldRunCLI() {
@@ -190,8 +198,6 @@ func main() {
 	flag.IntVar(&args.verbose, "verbose", defaultVerbosity(), "log verbosity level; 0 is default, 1 or higher are increasingly verbose")
 	flag.BoolVar(&args.cleanUp, "cleanup", false, "clean up system state and exit")
 	flag.StringVar(&args.debug, "debug", "", "listen address ([ip]:port) of optional debug server")
-	flag.StringVar(&args.socksAddr, "socks5-server", "", `optional [ip]:port to run a SOCK5 server (e.g. "localhost:1080")`)
-	flag.StringVar(&args.httpProxyAddr, "outbound-http-proxy-listen", "", `optional [ip]:port to run an outbound HTTP proxy (e.g. "localhost:8080")`)
 	flag.StringVar(&args.tunname, "tun", defaultTunName(), `tunnel interface name; use "userspace-networking" (beta) to not use TUN`)
 	flag.Var(flagtype.PortValue(&args.port, defaultPort()), "port", "UDP port to listen on for WireGuard and peer-to-peer traffic; 0 means automatically select")
 	flag.StringVar(&args.statepath, "state", "", "absolute path of state file; use 'kube:<secret-name>' to use Kubernetes secrets or 'arn:aws:ssm:...' to store in AWS SSM; use 'mem:' to not store state and register as an ephemeral node. If empty and --statedir is provided, the default is <statedir>/tailscaled.state. Default: "+paths.DefaultTailscaledStateFile())
@@ -202,6 +208,9 @@ func main() {
 	flag.BoolVar(&printVersion, "version", false, "print version information and exit")
 	flag.BoolVar(&args.disableLogs, "no-logs-no-support", false, "disable log uploads; this also disables any technical support")
 	flag.StringVar(&args.confFile, "config", "", "path to config file, or 'vm:user-data' to use the VM's user-data (EC2)")
+	if f, ok := hookRegisterOutboundProxyFlags.GetOk(); ok {
+		f()
+	}
 
 	if runtime.GOOS == "plan9" && os.Getenv("_NETSHELL_CHILD_") != "" {
 		os.Args = []string{"tailscaled", "be-child", "plan9-netshell"}
@@ -595,7 +604,10 @@ func getLocalBackend(ctx context.Context, logf logger.Logf, logID logid.PublicID
 		logPol.Logtail.SetNetMon(sys.NetMon.Get())
 	}
 
-	socksListener, httpProxyListener := mustStartProxyListeners(args.socksAddr, args.httpProxyAddr)
+	var startProxy proxyStartFunc
+	if listen, ok := hookOutboundProxyListen.GetOk(); ok {
+		startProxy = listen()
+	}
 
 	dialer := &tsdial.Dialer{Logf: logf} // mutated below (before used)
 	sys.Set(dialer)
@@ -646,26 +658,8 @@ func getLocalBackend(ctx context.Context, logf logger.Logf, logID logid.PublicID
 			return udpConn, nil
 		}
 	}
-	if socksListener != nil || httpProxyListener != nil {
+	if startProxy != nil {
-		var addrs []string
+		go startProxy(logf, dialer)
-		if httpProxyListener != nil {
-			hs := &http.Server{Handler: httpProxyHandler(dialer.UserDial)}
-			go func() {
-				log.Fatalf("HTTP proxy exited: %v", hs.Serve(httpProxyListener))
-			}()
-			addrs = append(addrs, httpProxyListener.Addr().String())
-		}
-		if socksListener != nil {
-			ss := &socks5.Server{
-				Logf:   logger.WithPrefix(logf, "socks5: "),
-				Dialer: dialer.UserDial,
-			}
-			go func() {
-				log.Fatalf("SOCKS5 server exited: %v", ss.Serve(socksListener))
-			}()
-			addrs = append(addrs, socksListener.Addr().String())
-		}
-		tshttpproxy.SetSelfProxy(addrs...)
 	}
 
 	opts := ipnServerOpts()
@@ -893,50 +887,6 @@ func newNetstack(logf logger.Logf, sys *tsd.System) (*netstack.Impl, error) {
 	return ret, nil
 }
 
-// mustStartProxyListeners creates listeners for local SOCKS and HTTP
-// proxies, if the respective addresses are not empty. socksAddr and
-// httpAddr can be the same, in which case socksListener will receive
-// connections that look like they're speaking SOCKS and httpListener
-// will receive everything else.
-//
-// socksListener and httpListener can be nil, if their respective
-// addrs are empty.
-func mustStartProxyListeners(socksAddr, httpAddr string) (socksListener, httpListener net.Listener) {
-	if socksAddr == httpAddr && socksAddr != "" && !strings.HasSuffix(socksAddr, ":0") {
-		ln, err := net.Listen("tcp", socksAddr)
-		if err != nil {
-			log.Fatalf("proxy listener: %v", err)
-		}
-		return proxymux.SplitSOCKSAndHTTP(ln)
-	}
-
-	var err error
-	if socksAddr != "" {
-		socksListener, err = net.Listen("tcp", socksAddr)
-		if err != nil {
-			log.Fatalf("SOCKS5 listener: %v", err)
-		}
-		if strings.HasSuffix(socksAddr, ":0") {
-			// Log kernel-selected port number so integration tests
-			// can find it portably.
-			log.Printf("SOCKS5 listening on %v", socksListener.Addr())
-		}
-	}
-	if httpAddr != "" {
-		httpListener, err = net.Listen("tcp", httpAddr)
-		if err != nil {
-			log.Fatalf("HTTP proxy listener: %v", err)
-		}
-		if strings.HasSuffix(httpAddr, ":0") {
-			// Log kernel-selected port number so integration tests
-			// can find it portably.
-			log.Printf("HTTP proxy listening on %v", httpListener.Addr())
-		}
-	}
-
-	return socksListener, httpListener
-}
-
 var beChildFunc = beChild
 
 func beChild(args []string) error {

feature/buildfeatures/feature_netstack_disabled.go

@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_netstack
+
+package buildfeatures
+
+// HasNetstack is whether the binary was built with support for modular feature "gVisor netstack (userspace networking) support (TODO; not yet omittable)".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_netstack" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasNetstack = false

feature/buildfeatures/feature_netstack_enabled.go

@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_netstack
+
+package buildfeatures
+
+// HasNetstack is whether the binary was built with support for modular feature "gVisor netstack (userspace networking) support (TODO; not yet omittable)".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_netstack" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasNetstack = true

feature/buildfeatures/feature_outboundproxy_disabled.go

@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build ts_omit_outboundproxy
+
+package buildfeatures
+
+// HasOutboundProxy is whether the binary was built with support for modular feature "Outbound localhost HTTP/SOCK5 proxy support".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_outboundproxy" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasOutboundProxy = false

feature/buildfeatures/feature_outboundproxy_enabled.go

@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by gen.go; DO NOT EDIT.
+
+//go:build !ts_omit_outboundproxy
+
+package buildfeatures
+
+// HasOutboundProxy is whether the binary was built with support for modular feature "Outbound localhost HTTP/SOCK5 proxy support".
+// Specifically, it's whether the binary was NOT built with the "ts_omit_outboundproxy" build tag.
+// It's a const so it can be used for dead code elimination.
+const HasOutboundProxy = true

feature/featuretags/featuretags.go

@@ -106,17 +106,31 @@ var Features = map[FeatureTag]FeatureMeta{
 	"drive":            {"Drive", "Tailscale Drive (file server) support", nil},
 	"kube":             {"Kube", "Kubernetes integration", nil},
 	"oauthkey":         {"OAuthKey", "OAuth secret-to-authkey resolution support", nil},
-	"portmapper":       {"PortMapper", "NAT-PMP/PCP/UPnP port mapping support", nil},
+	"outboundproxy": {
-	"relayserver":      {"RelayServer", "Relay server", nil},
+		Sym:  "OutboundProxy",
-	"serve":            {"Serve", "Serve and Funnel support", nil},
+		Desc: "Outbound localhost HTTP/SOCK5 proxy support",
-	"ssh":              {"SSH", "Tailscale SSH support", nil},
+		Deps: []FeatureTag{"netstack"},
-	"syspolicy":        {"SystemPolicy", "System policy configuration (MDM) support", nil},
+	},
-	"systray":          {"SysTray", "Linux system tray", nil},
+	"portmapper":  {"PortMapper", "NAT-PMP/PCP/UPnP port mapping support", nil},
-	"taildrop":         {"Taildrop", "Taildrop (file sending) support", nil},
+	"netstack":    {"Netstack", "gVisor netstack (userspace networking) support (TODO; not yet omittable)", nil},
-	"tailnetlock":      {"TailnetLock", "Tailnet Lock support", nil},
+	"relayserver": {"RelayServer", "Relay server", nil},
-	"tap":              {"Tap", "Experimental Layer 2 (ethernet) support", nil},
+	"serve": {
-	"tpm":              {"TPM", "TPM support", nil},
+		Sym:  "Serve",
-	"wakeonlan":        {"WakeOnLAN", "Wake-on-LAN support", nil},
+		Desc: "Serve and Funnel support",
+		Deps: []FeatureTag{"netstack"},
+	},
+	"ssh": {
+		Sym:  "SSH",
+		Desc: "Tailscale SSH support",
+		Deps: []FeatureTag{"netstack"},
+	},
+	"syspolicy":   {"SystemPolicy", "System policy configuration (MDM) support", nil},
+	"systray":     {"SysTray", "Linux system tray", nil},
+	"taildrop":    {"Taildrop", "Taildrop (file sending) support", nil},
+	"tailnetlock": {"TailnetLock", "Tailnet Lock support", nil},
+	"tap":         {"Tap", "Experimental Layer 2 (ethernet) support", nil},
+	"tpm":         {"TPM", "TPM support", nil},
+	"wakeonlan":   {"WakeOnLAN", "Wake-on-LAN support", nil},
 	"webclient": {
 		Sym: "WebClient", Desc: "Web client support",
 		Deps: []FeatureTag{"serve"},

feature/featuretags/featuretags_test.go

@@ -11,7 +11,7 @@ import (
 	"tailscale.com/util/set"
 )
 
-func TestRequires(t *testing.T) {
+func TestKnownDeps(t *testing.T) {
 	for tag, meta := range Features {
 		for _, dep := range meta.Deps {
 			if _, ok := Features[dep]; !ok {
@@ -26,7 +26,7 @@ func TestRequires(t *testing.T) {
 	}
 }
 
-func TestDepSet(t *testing.T) {
+func TestRequires(t *testing.T) {
 	var setOf = set.Of[FeatureTag]
 	tests := []struct {
 		in   FeatureTag
@@ -38,11 +38,11 @@ func TestDepSet(t *testing.T) {
 		},
 		{
 			in:   "serve",
-			want: setOf("serve"),
+			want: setOf("serve", "netstack"),
 		},
 		{
 			in:   "webclient",
-			want: setOf("webclient", "serve"),
+			want: setOf("webclient", "serve", "netstack"),
 		},
 	}
 	for _, tt := range tests {