cmd/nginx-auth: allow use of shared nodes

When sharing nodes, the name of the sharee node is not exposed (instead
it is hardcoded to "device-of-shared-to-user"), which means that we
can't determine the tailnet of that node.  Don't immediately fail when
that happens, since it only matters if "Expected-Tailnet" is used.

Signed-off-by: Will Norris <will@tailscale.com>

cmd/nginx-auth/nginx-auth.go

@@ -63,17 +63,24 @@ func main() {
 			return
 		}
 
-		_, tailnet, ok := strings.Cut(info.Node.Name, info.Node.ComputedName+".")
+		// tailnet of connected node. When accessing shared nodes, this
-		if !ok {
+		// will be empty because the tailnet of the sharee is not exposed.
-			w.WriteHeader(http.StatusUnauthorized)
+		var tailnet string
-			log.Printf("can't extract tailnet name from hostname %q", info.Node.Name)
+
-			return
+		if !info.Node.Hostinfo.ShareeNode() {
-		}
+			var ok bool
-		tailnet, _, ok = strings.Cut(tailnet, ".beta.tailscale.net")
+			_, tailnet, ok = strings.Cut(info.Node.Name, info.Node.ComputedName+".")
-		if !ok {
+			if !ok {
-			w.WriteHeader(http.StatusUnauthorized)
+				w.WriteHeader(http.StatusUnauthorized)
-			log.Printf("can't extract tailnet name from hostname %q", info.Node.Name)
+				log.Printf("can't extract tailnet name from hostname %q", info.Node.Name)
-			return
+				return
+			}
+			tailnet, _, ok = strings.Cut(tailnet, ".beta.tailscale.net")
+			if !ok {
+				w.WriteHeader(http.StatusUnauthorized)
+				log.Printf("can't extract tailnet name from hostname %q", info.Node.Name)
+				return
+			}
 		}
 
 		if expectedTailnet := r.Header.Get("Expected-Tailnet"); expectedTailnet != "" && expectedTailnet != tailnet {