mirror of https://github.com/tailscale/tailscale/
net/ace, control/controlhttp: start adding ACE dialing support
Updates tailscale/corp#32227 Change-Id: I38afc668f99eb1d6f7632e82554b82922f3ebb9f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>pull/17201/head
Brad Fitzpatrick
3 months ago
committed by
Brad Fitzpatrick
parent
b9cda4bca5
commit
ecfdd86fc9
@ -0,0 +1,123 @@
|
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Package ace implements a Dialer that dials via a Tailscale ACE (CONNECT)
|
||||
// proxy.
|
||||
//
|
||||
// TODO: document this more, when it's more done. As of 2025-09-17, it's in
|
||||
// development.
|
||||
package ace
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"cmp"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"sync/atomic"
|
||||
)
|
||||
|
||||
// Dialer is an HTTP CONNECT proxy dialer to dial the control plane via an ACE
|
||||
// proxy.
|
||||
type Dialer struct {
|
||||
ACEHost string
|
||||
ACEHostIP netip.Addr // optional; if non-zero, use this IP instead of DNS
|
||||
ACEPort int // zero means 443
|
||||
|
||||
NetDialer func(ctx context.Context, network, address string) (net.Conn, error)
|
||||
}
|
||||
|
||||
func (d *Dialer) netDialer() func(ctx context.Context, network, address string) (net.Conn, error) {
|
||||
if d.NetDialer != nil {
|
||||
return d.NetDialer
|
||||
}
|
||||
var std net.Dialer
|
||||
return std.DialContext
|
||||
}
|
||||
|
||||
func (d *Dialer) acePort() int { return cmp.Or(d.ACEPort, 443) }
|
||||
|
||||
func (d *Dialer) Dial(ctx context.Context, network, address string) (_ net.Conn, err error) {
|
||||
if network != "tcp" {
|
||||
return nil, errors.New("only TCP is supported")
|
||||
}
|
||||
|
||||
var targetHost string
|
||||
if d.ACEHostIP.IsValid() {
|
||||
targetHost = d.ACEHostIP.String()
|
||||
} else {
|
||||
targetHost = d.ACEHost
|
||||
}
|
||||
|
||||
cc, err := d.netDialer()(ctx, "tcp", net.JoinHostPort(targetHost, fmt.Sprint(d.acePort())))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Now that we've dialed, we're about to do three potentially blocking
|
||||
// operations: the TLS handshake, the CONNECT write, and the HTTP response
|
||||
// read. To make our context work over all that, we use a context.AfterFunc
|
||||
// to start a goroutine that'll tear down the underlying connection if the
|
||||
// context expires.
|
||||
//
|
||||
// To prevent races, we use an atomic.Bool to guard access to the underlying
|
||||
// connection being either good or bad. Only one goroutine (the success path
|
||||
// in this goroutine after the ReadResponse or the AfterFunc's failure
|
||||
// goroutine) will compare-and-swap it from false to true.
|
||||
var done atomic.Bool
|
||||
stop := context.AfterFunc(ctx, func() {
|
||||
if done.CompareAndSwap(false, true) {
|
||||
cc.Close()
|
||||
}
|
||||
})
|
||||
defer func() {
|
||||
if err != nil {
|
||||
if ctx.Err() != nil {
|
||||
// Prefer the context error. The other error is likely a side
|
||||
// effect of the context expiring and our tearing down of the
|
||||
// underlying connection, and is thus probably something like
|
||||
// "use of closed network connection", which isn't useful (and
|
||||
// actually misleading) for the caller.
|
||||
err = ctx.Err()
|
||||
}
|
||||
stop()
|
||||
cc.Close()
|
||||
}
|
||||
}()
|
||||
|
||||
tc := tls.Client(cc, &tls.Config{ServerName: d.ACEHost})
|
||||
if err := tc.Handshake(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// TODO(tailscale/corp#32484): send proxy-auth header
|
||||
if _, err := fmt.Fprintf(tc, "CONNECT %s HTTP/1.1\r\nHost: %s\r\n\r\n", address, d.ACEHost); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
br := bufio.NewReader(tc)
|
||||
connRes, err := http.ReadResponse(br, &http.Request{Method: "CONNECT"})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("reading CONNECT response: %w", err)
|
||||
}
|
||||
|
||||
// Now that we're done with blocking operations, mark the connection
|
||||
// as good, to prevent the context's AfterFunc from closing it.
|
||||
if !stop() || !done.CompareAndSwap(false, true) {
|
||||
// We lost a race and the context expired.
|
||||
return nil, ctx.Err()
|
||||
}
|
||||
|
||||
if connRes.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("ACE CONNECT response: %s", connRes.Status)
|
||||
}
|
||||
|
||||
if br.Buffered() > 0 {
|
||||
return nil, fmt.Errorf("unexpected %d bytes of buffered data after ACE CONNECT", br.Buffered())
|
||||
}
|
||||
return tc, nil
|
||||
}
|
||||
Loading…
Reference in New Issue