You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Nick Khyl 892f8a9582 various: allow tailscaled shutdown via LocalAPI
A customer wants to allow their employees to restart tailscaled at will, when access rights and MDM policy allow it,
as a way to fully reset client state and re-create the tunnel in case of connectivity issues.

On Windows, the main tailscaled process runs as a child of a service process. The service restarts the child
when it exits (or crashes) until the service itself is stopped. Regular (non-admin) users can't stop the service,
and allowing them to do so isn't ideal, especially in managed or multi-user environments.

In this PR, we add a LocalAPI endpoint that instructs ipnserver.Server, and by extension the tailscaled process,
to shut down. The service then restarts the child tailscaled. Shutting down tailscaled requires LocalAPI write access
and an enabled policy setting.

Updates tailscale/corp#32674
Updates tailscale/corp#32675

Signed-off-by: Nick Khyl <nickk@tailscale.com>
2 months ago
..
auditlog ipn/ipnext: remove some interface indirection to add hooks 7 months ago
conffile ipn/conffile: don't depend on hujson on iOS/Android 1 year ago
desktop util/syspolicy: finish plumbing policyclient, add feature/syspolicy, move global impl 3 months ago
ipnauth ipn/ipnauth: don't crash on OpenBSD trying to log username of unknown peer 2 months ago
ipnext feature/portlist: pull portlist service porting into extension, use eventbus 2 months ago
ipnlocal feature/portlist: pull portlist service porting into extension, use eventbus 2 months ago
ipnserver various: allow tailscaled shutdown via LocalAPI 2 months ago
ipnstate cmd/tailscale, ipn/ipnstate, wgengine/magicsock: update ping output for peer relay (#16515) 5 months ago
lapitest various: allow tailscaled shutdown via LocalAPI 2 months ago
localapi various: allow tailscaled shutdown via LocalAPI 2 months ago
policy ipn,tailconfig: clean up unreleased and removed app connector service 2 years ago
store ipn/store/kubestore,kube: fix cert error in admin UI (#16717) 4 months ago
backend.go ipn: fix the string representation of an empty ipn.Notify 3 months ago
backend_test.go ipn: fix the string representation of an empty ipn.Notify 3 months ago
conf.go ipn: ensure that conffile is source of truth for advertised services. (#15361) 9 months ago
doc.go ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate 10 months ago
ipn_clone.go cmd/tailscale/cli,ipn,ipn/ipnlocal: add AutoExitNode preference for automatic exit node selection 5 months ago
ipn_test.go all: do not depend on the testing package 2 years ago
ipn_view.go cmd/viewer: add field comments to generated view methods 3 months ago
prefs.go cmd/tailscale: use tailnet display name on cli (#17079) 3 months ago
prefs_test.go ipn: warn about self as the exit node if backend is running (#17018) 3 months ago
serve.go cmd/tailscale/cli: revert key for web config for services to FQDN (#16627) 4 months ago
serve_test.go cmd/tailscale/cli: Add service flag to serve command (#16191) 5 months ago
store.go tailcfg: report StateEncrypted in Hostinfo (#16434) 5 months ago
store_test.go ipn/store: automatically migrate between plaintext and encrypted state (#16318) 5 months ago