controlhttp

Documentation

Overview

Package controlhttp implements the Tailscale 2021 control protocol base transport over HTTP.

This tunnels the protocol in control/controlbase over HTTP with a variety of compatibility fallbacks for handling picky or deep inspecting proxies.

In the happy path, a client makes a single cleartext HTTP request to the server, the server responds with 101 Switching Protocols, and the control base protocol takes place over plain TCP.

In the compatibility path, the client does the above over HTTPS, resulting in double encryption (once for the control transport, and once for the outer TLS layer).

Index

• func AcceptHTTP(ctx context.Context, w http.ResponseWriter, r *http.Request, ...) (*controlbase.Conn, error)
• type ClientConn
• type Dialer
  • func (a *Dialer) Dial(ctx context.Context) (*ClientConn, error)

Functions

func AcceptHTTP

func AcceptHTTP(ctx context.Context, w http.ResponseWriter, r *http.Request, private key.MachinePrivate, earlyWrite func(protocolVersion int, w io.Writer) error) (*controlbase.Conn, error)

AcceptHTTP upgrades the HTTP request given by w and r into a Tailscale control protocol base transport connection.

AcceptHTTP always writes an HTTP response to w. The caller must not attempt their own response after calling AcceptHTTP.

earlyWrite optionally specifies a func to write to the noise connection (encrypted). It receives the negotiated version and a writer to write to, if desired.

Types

type ClientConn

type ClientConn struct {
	// Conn is the noise connection.
	*controlbase.Conn
}

ClientConn is a Tailscale control client as returned by the Dialer.

It's effectively just a *controlbase.Conn (which it embeds) with optional metadata.

type Dialer

type Dialer struct {
	// Hostname is the hostname to connect to, with no port number.
	//
	// This field is required.
	Hostname string

	// MachineKey contains the current machine's private key.
	//
	// This field is required.
	MachineKey key.MachinePrivate

	// ControlKey contains the expected public key for the control server.
	//
	// This field is required.
	ControlKey key.MachinePublic

	// ProtocolVersion is the expected protocol version to negotiate.
	//
	// This field is required.
	ProtocolVersion uint16

	// HTTPPort is the port number to use when making a HTTP connection.
	//
	// If not specified, this defaults to port 80.
	HTTPPort string

	// HTTPSPort is the port number to use when making a HTTPS connection.
	//
	// If not specified, this defaults to port 443.
	HTTPSPort string

	// Dialer is the dialer used to make outbound connections.
	//
	// If not specified, this defaults to net.Dialer.DialContext.
	Dialer dnscache.DialContextFunc

	// Logf, if set, is a logging function to use; if unset, logs are
	// dropped.
	Logf logger.Logf

	NetMon *netmon.Monitor

	// DialPlan, if set, contains instructions from the control server on
	// how to connect to it. If present, we will try the methods in this
	// plan before falling back to DNS.
	DialPlan *tailcfg.ControlDialPlan
	// contains filtered or unexported fields
}

Dialer contains configuration on how to dial the Tailscale control server.

func (*Dialer) Dial

func (a *Dialer) Dial(ctx context.Context) (*ClientConn, error)

Dial connects to the HTTP server at this Dialer's Host:HTTPPort, requests to switch to the Tailscale control protocol, and returns an established control protocol connection.

If Dial fails to connect using HTTP, it also tries to tunnel over TLS to the Dialer's Host:HTTPSPort as a compatibility fallback.

The provided ctx is only used for the initial connection, until Dial returns. It does not affect the connection once established.