cmd/derper: provide debug access over port 80 to trusted (tailscale) IPs

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
reviewable/pr90/r1
Brad Fitzpatrick 5 years ago
parent cc44e8a443
commit c763901b1a

@ -19,6 +19,7 @@ import (
_ "net/http/pprof"
"os"
"path/filepath"
"strings"
"time"
"github.com/tailscale/wireguard-go/wgcfg"
@ -172,7 +173,7 @@ func main() {
}
httpsrv.TLSConfig = certManager.TLSConfig()
go func() {
err := http.ListenAndServe(":80", certManager.HTTPHandler(nil))
err := http.ListenAndServe(":80", certManager.HTTPHandler(port80Handler{mux}))
if err != nil {
if err != http.ErrServerClosed {
log.Fatal(err)
@ -212,6 +213,34 @@ func allowDebugAccess(r *http.Request) bool {
return interfaces.IsTailscaleIP(ip) || ip.IsLoopback() || ipStr == os.Getenv("ALLOW_DEBUG_IP")
}
type port80Handler struct{ tlsHandler http.Handler }
func (h port80Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
path := r.RequestURI
if path == "/debug" || strings.HasPrefix(path, "/debug") {
h.tlsHandler.ServeHTTP(w, r)
return
}
if r.Method != "GET" && r.Method != "HEAD" {
http.Error(w, "Use HTTPS", http.StatusBadRequest)
return
}
if path == "/" && allowDebugAccess(r) {
// Redirect authorized user to the debug handler.
path = "/debug/"
}
target := "https://" + stripPort(r.Host) + path
http.Redirect(w, r, target, http.StatusFound)
}
func stripPort(hostport string) string {
host, _, err := net.SplitHostPort(hostport)
if err != nil {
return hostport
}
return net.JoinHostPort(host, "443")
}
func debugHandler(s *derp.Server) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
f := func(format string, args ...interface{}) { fmt.Fprintf(w, format, args...) }

Loading…
Cancel
Save