MyFavMirrors
/
headscale
mirror of https://github.com/juanfont/headscale.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
headscale/hscontrol/handlers.go

245 lines
6.3 KiB
Go
Raw Normal View History

rename package name to hscontrol Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-10 03:24:05 -04:00
package hscontrol
Initial commit
2020-06-21 06:32:08 -04:00
import (
Template Fixes
2021-12-22 21:43:53 -05:00
"bytes"
Initial commit
2020-06-21 06:32:08 -04:00
"encoding/json"
create DB struct This is step one in detaching the Database layer from Headscale (h). The ultimate goal is to have all function that does database operations in its own package, and keep the business logic and writing separate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-11 03:09:18 -04:00
"errors"
Template Fixes
2021-12-22 21:43:53 -05:00
"html/template"
Initial commit
2020-06-21 06:32:08 -04:00
"net/http"
rename handler files This commit renames a bunch of files to try to make it a bit less confusing; protocol_ is now auth as they contained registration, auth and login/out flow protocol_.*_poll is now poll.go api.go and other generic handlers are now handlers.go Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-06-06 11:14:56 -04:00
"strconv"
Initial commit
2020-06-21 06:32:08 -04:00
"time"
Remove Gin from the Registration handler
2022-06-20 06:30:41 -04:00
"github.com/gorilla/mux"
create DB struct This is step one in detaching the Database layer from Headscale (h). The ultimate goal is to have all function that does database operations in its own package, and keep the business logic and writing separate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-11 03:09:18 -04:00
"github.com/juanfont/headscale/hscontrol/util"
golangci-lint --fix
2021-11-13 03:39:04 -05:00
"github.com/rs/zerolog/log"
rename handler files This commit renames a bunch of files to try to make it a bit less confusing; protocol_ is now auth as they contained registration, auth and login/out flow protocol_.*_poll is now poll.go api.go and other generic handlers are now handlers.go Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-06-06 11:14:56 -04:00
"tailscale.com/tailcfg"
Protect against user injection for registration CLI page This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation. We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2022-09-23 04:39:42 -04:00
"tailscale.com/types/key"
Initial commit
2020-06-21 06:32:08 -04:00
)
Make "authKey" a constant
2021-11-18 03:49:55 -05:00
const (
rename handler files This commit renames a bunch of files to try to make it a bit less confusing; protocol_ is now auth as they contained registration, auth and login/out flow protocol_.*_poll is now poll.go api.go and other generic handlers are now handlers.go Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-06-06 11:14:56 -04:00
// The CapabilityVersion is used by Tailscale clients to indicate
// their codebase version. Tailscale clients can communicate over TS2021
// from CapabilityVersion 28, but we only have good support for it
// since https://github.com/tailscale/tailscale/pull/4323 (Noise in any HTTPS port).
//
// Related to this change, there is https://github.com/tailscale/tailscale/pull/5379,
// where CapabilityVersion 39 is introduced to indicate #4323 was merged.
//
// See also https://github.com/tailscale/tailscale/blob/main/tailcfg/tailcfg.go
NoiseCapabilityVersion = 39
Added missing dot in comment
2022-08-12 03:36:17 -04:00
// TODO(juan): remove this once https://github.com/juanfont/headscale/issues/727 is fixed.
create DB struct This is step one in detaching the Database layer from Headscale (h). The ultimate goal is to have all function that does database operations in its own package, and keep the business logic and writing separate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-11 03:09:18 -04:00
registrationHoldoff = time.Second * 5
reservedResponseHeaderSize = 4
)
var ErrRegisterMethodCLIDoesNotSupportExpire = errors.New(
"machines registered with CLI does not support expire",
Make "authKey" a constant
2021-11-18 03:49:55 -05:00
)
Remove all instances of undefined numbers (gonmd)
2021-11-14 12:31:51 -05:00
rename handler files This commit renames a bunch of files to try to make it a bit less confusing; protocol_ is now auth as they contained registration, auth and login/out flow protocol_.*_poll is now poll.go api.go and other generic handlers are now handlers.go Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-06-06 11:14:56 -04:00
// KeyHandler provides the Headscale pub key
// Listens in /key.
func (h *Headscale) KeyHandler(
writer http.ResponseWriter,
req *http.Request,
) {
// New Tailscale clients send a 'v' parameter to indicate the CurrentCapabilityVersion
clientCapabilityStr := req.URL.Query().Get("v")
if clientCapabilityStr != "" {
log.Debug().
Str("handler", "/key").
Str("v", clientCapabilityStr).
Msg("New noise client")
clientCapabilityVersion, err := strconv.Atoi(clientCapabilityStr)
if err != nil {
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
_, err := writer.Write([]byte("Wrong params"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
return
}
// TS2021 (Tailscale v2 protocol) requires to have a different key
if clientCapabilityVersion >= NoiseCapabilityVersion {
resp := tailcfg.OverTLSPublicKeyResponse{
LegacyPublicKey: h.privateKey2019.Public(),
PublicKey: h.noisePrivateKey.Public(),
}
writer.Header().Set("Content-Type", "application/json")
writer.WriteHeader(http.StatusOK)
err = json.NewEncoder(writer).Encode(resp)
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
return
}
}
log.Debug().
Str("handler", "/key").
Msg("New legacy client")
// Old clients don't send a 'v' parameter, so we send the legacy public key
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusOK)
_, err := writer.Write([]byte(util.MachinePublicKeyStripPrefix(h.privateKey2019.Public())))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
}
ping db in health check
2022-07-06 07:39:10 -04:00
func (h *Headscale) HealthHandler(
writer http.ResponseWriter,
req *http.Request,
) {
respond := func(err error) {
writer.Header().Set("Content-Type", "application/health+json; charset=utf-8")
res := struct {
Status string `json:"status"`
}{
Status: "pass",
}
if err != nil {
writer.WriteHeader(http.StatusInternalServerError)
log.Error().Caller().Err(err).Msg("health check failed")
res.Status = "fail"
}
buf, err := json.Marshal(res)
if err != nil {
log.Error().Caller().Err(err).Msg("marshal failed")
}
_, err = writer.Write(buf)
if err != nil {
log.Error().Caller().Err(err).Msg("write failed")
}
}
Split code into modules This is a massive commit that restructures the code into modules: db/ All functions related to modifying the Database types/ All type definitions and methods that can be exclusivly used on these types without dependencies policy/ All Policy related code, now without dependencies on the Database. policy/matcher/ Dedicated code to match machines in a list of FilterRules Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-21 12:37:59 -04:00
if err := h.db.PingDB(req.Context()); err != nil {
ping db in health check
2022-07-06 07:39:10 -04:00
respond(err)
return
}
respond(nil)
}
Template Fixes
2021-12-22 21:43:53 -05:00
type registerWebAPITemplateConfig struct {
Key string
}
Initial multi-user support using namespaces
2021-02-27 18:58:09 -05:00
Template Fixes
2021-12-22 21:43:53 -05:00
var registerWebAPITemplate = template.Must(
fix: make register html/template consistent with other html - makes the html/template for /register follow the same formatting as /apple and /windows - adds a <title> element - minor change for consistency's sake
2022-03-08 03:34:46 -05:00
template.New("registerweb").Parse(`
<html>
<head>
<title>Registration - Headscale</title>
</head>
Initial multi-user support using namespaces
2021-02-27 18:58:09 -05:00
<body>
fix: make register html/template consistent with other html - makes the html/template for /register follow the same formatting as /apple and /windows - adds a <title> element - minor change for consistency's sake
2022-03-08 03:34:46 -05:00
<h1>headscale</h1>
<h2>Machine registration</h2>
<p>
Run the command below in the headscale server to add this machine to your network:
</p>
Update the node join instruction to reference "username" related to https://github.com/juanfont/headscale/pull/1144 Signed-off-by: Christian Heusel <christian@heusel.eu>
2023-01-19 19:37:37 -05:00
<pre><code>headscale nodes register --user USERNAME --key {{.Key}}</code></pre>
Initial multi-user support using namespaces
2021-02-27 18:58:09 -05:00
</body>
fix: make register html/template consistent with other html - makes the html/template for /register follow the same formatting as /apple and /windows - adds a <title> element - minor change for consistency's sake
2022-03-08 03:34:46 -05:00
</html>
`))
Template Fixes
2021-12-22 21:43:53 -05:00
// RegisterWebAPI shows a simple message in the browser to point to the CLI
Improve protocol implementation for client registration (fixes #706)
2022-08-11 06:11:02 -04:00
// Listens in /register/:nkey.
Added comment clarifying registration API
2022-08-11 06:16:50 -04:00
//
// This is not part of the Tailscale control API, as we could send whatever URL
// in the RegisterResponse.AuthURL field.
Remove Gin from simple endpoints for TS2019
2022-06-17 10:48:04 -04:00
func (h *Headscale) RegisterWebAPI(
Lint fixes 2/n
2022-06-26 05:55:37 -04:00
writer http.ResponseWriter,
req *http.Request,
Remove Gin from simple endpoints for TS2019
2022-06-17 10:48:04 -04:00
) {
Improve protocol implementation for client registration (fixes #706)
2022-08-11 06:11:02 -04:00
vars := mux.Vars(req)
nodeKeyStr, ok := vars["nkey"]
Protect against user injection for registration CLI page This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation. We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2022-09-23 04:39:42 -04:00
create DB struct This is step one in detaching the Database layer from Headscale (h). The ultimate goal is to have all function that does database operations in its own package, and keep the business logic and writing separate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-11 03:09:18 -04:00
if !util.NodePublicKeyRegex.Match([]byte(nodeKeyStr)) {
Validate the incoming nodekey with regex before attempting to parse Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2022-09-23 05:51:38 -04:00
log.Warn().Str("node_key", nodeKeyStr).Msg("Invalid node key passed to registration url")
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusUnauthorized)
_, err := writer.Write([]byte("Unauthorized"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
return
}
Protect against user injection for registration CLI page This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation. We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2022-09-23 04:39:42 -04:00
// We need to make sure we dont open for XSS style injections, if the parameter that
// is passed as a key is not parsable/validated as a NodePublic key, then fail to render
// the template and log an error.
var nodeKey key.NodePublic
err := nodeKey.UnmarshalText(
create DB struct This is step one in detaching the Database layer from Headscale (h). The ultimate goal is to have all function that does database operations in its own package, and keep the business logic and writing separate. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2023-05-11 03:09:18 -04:00
[]byte(util.NodePublicKeyEnsurePrefix(nodeKeyStr)),
Protect against user injection for registration CLI page This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation. We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2022-09-23 04:39:42 -04:00
)
if !ok || nodeKeyStr == "" || err != nil {
log.Warn().Err(err).Msg("Failed to parse incoming nodekey")
Lint fixes 2/n
2022-06-26 05:55:37 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusBadRequest)
Lint fixes 5/n
2022-06-26 06:21:35 -04:00
_, err := writer.Write([]byte("Wrong params"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
Template Fixes
2021-12-22 21:43:53 -05:00
return
}
var content bytes.Buffer
if err := registerWebAPITemplate.Execute(&content, registerWebAPITemplateConfig{
Replace machine key with node key in preparation for Noise in auth related stuff
2022-08-10 09:35:26 -04:00
Key: nodeKeyStr,
Template Fixes
2021-12-22 21:43:53 -05:00
}); err != nil {
log.Error().
Str("func", "RegisterWebAPI").
Err(err).
Msg("Could not render register web API template")
Lint fixes 2/n
2022-06-26 05:55:37 -04:00
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.WriteHeader(http.StatusInternalServerError)
Lint fixes 5/n
2022-06-26 06:21:35 -04:00
_, err = writer.Write([]byte("Could not render register web API template"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
Lint fixes 2/n
2022-06-26 05:55:37 -04:00
return
Template Fixes
2021-12-22 21:43:53 -05:00
}
Improved tailnode start up handling
2021-05-24 15:59:03 -04:00
Lint fixes 2/n
2022-06-26 05:55:37 -04:00
writer.Header().Set("Content-Type", "text/html; charset=utf-8")
writer.WriteHeader(http.StatusOK)
Protect against user injection for registration CLI page This commit addresses a potential issue where we allowed unsanitised content to be passed through a go template without validation. We now try to unmarshall the incoming node key and fails to render the template if it is not a valid node key. Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2022-09-23 04:39:42 -04:00
_, err = writer.Write(content.Bytes())
Lint fixes 5/n
2022-06-26 06:21:35 -04:00
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
Initial multi-user support using namespaces
2021-02-27 18:58:09 -05:00
}