webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

cmd/tailscale/cli: show services in serve status (#19600)

Browse Source 
The "tailscale serve status" human-readable output previously showed
only serve-based proxies, not services.

Fixes https://github.com/tailscale/corp/issues/34163

Change-Id: Ie48858a8d8afd7184979d0fe2ab21ebd6fd0d4a0

Signed-off-by: Kabir Sikand <kabir@tailscale.com>
This commit is contained in:
Kabir
2026-06-02 17:09:54 -04:00
committed by GitHub
parent 9107354488
commit 01c59d84a0
3 changed files with 478 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/tailscale/cli/serve_status_test.go
+308
View File
@@ -0,0 +1,308 @@
// Copyright (c) Tailscale Inc & contributors
// SPDX-License-Identifier: BSD-3-Clause
//go:build !ts_omit_serve
package cli
import (
"bytes"
"encoding/json"
"io"
"net"
"strings"
"testing"
"tailscale.com/ipn"
"tailscale.com/ipn/ipnstate"
"tailscale.com/tailcfg"
"tailscale.com/tstest"
)
// statusTestStatus is a minimal ipnstate.Status used by serve-status tests.
var statusTestStatus = &ipnstate.Status{
BackendState: ipn.Running.String(),
Self: &ipnstate.PeerStatus{
DNSName: "foo.test.ts.net.",
},
CurrentTailnet: &ipnstate.TailnetStatus{MagicDNSSuffix: "test.ts.net"},
}
func TestPrintServeStatusTrees(t *testing.T) {
tests := []struct {
name string
sc *ipn.ServeConfig
want string
}{
{
name: "node_web_tailnet_only",
sc: &ipn.ServeConfig{
TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/": {Proxy: "http://127.0.0.1:3000"},
}},
},
},
want: strings.Join([]string{
"https://foo.test.ts.net (tailnet only)",
"|-- / proxy http://127.0.0.1:3000",
"",
"",
}, "\n"),
},
{
name: "node_tcp_funnel_on",
sc: &ipn.ServeConfig{
TCP: map[uint16]*ipn.TCPPortHandler{2222: {TCPForward: "127.0.0.1:22"}},
AllowFunnel: map[ipn.HostPort]bool{
"foo.test.ts.net:2222": true,
},
},
want: strings.Join([]string{
"|-- tcp://foo.test.ts.net:2222 (Funnel on)",
"|--> tcp://127.0.0.1:22",
"",
"",
}, "\n"),
},
{
name: "node_tls_terminated_tcp_tailnet",
sc: &ipn.ServeConfig{
TCP: map[uint16]*ipn.TCPPortHandler{
443: {TCPForward: "127.0.0.1:8080", TerminateTLS: "foo.test.ts.net"},
},
},
want: strings.Join([]string{
"|-- tcp://foo.test.ts.net:443 (TLS-terminated TCP, tailnet only)",
"|--> tcp://127.0.0.1:8080",
"",
"",
}, "\n"),
},
{
name: "service_web_only",
sc: &ipn.ServeConfig{
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
"svc:db": {
TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"db.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/": {Proxy: "http://127.0.0.1:5432"},
}},
},
},
},
},
want: strings.Join([]string{
"https://db.test.ts.net (tailnet only) (svc:db)",
"|-- / proxy http://127.0.0.1:5432",
"",
"",
}, "\n"),
},
{
name: "service_tcp_forward",
sc: &ipn.ServeConfig{
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
"svc:ssh": {
TCP: map[uint16]*ipn.TCPPortHandler{2222: {TCPForward: "127.0.0.1:22"}},
},
},
},
want: strings.Join([]string{
"tcp://ssh.test.ts.net:2222 (tailnet only) (svc:ssh)",
"|--> tcp://127.0.0.1:22",
"",
"",
}, "\n"),
},
{
name: "service_tls_terminated_tcp",
sc: &ipn.ServeConfig{
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
"svc:foo": {
TCP: map[uint16]*ipn.TCPPortHandler{
443: {TCPForward: "127.0.0.1:8080", TerminateTLS: "foo.test.ts.net"},
},
},
},
},
want: strings.Join([]string{
"tcp://foo.test.ts.net:443 (TLS-terminated TCP, tailnet only) (svc:foo)",
"|--> tcp://127.0.0.1:8080",
"",
"",
}, "\n"),
},
{
name: "service_tun",
sc: &ipn.ServeConfig{
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
"svc:vpn": {Tun: true},
},
},
want: strings.Join([]string{
"tun (L3 forwarding) (svc:vpn)",
"",
"",
}, "\n"),
},
{
name: "node_and_services_mixed",
sc: &ipn.ServeConfig{
TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/": {Proxy: "http://127.0.0.1:3000"},
}},
},
AllowFunnel: map[ipn.HostPort]bool{
"foo.test.ts.net:443": true,
},
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
"svc:db": {
TCP: map[uint16]*ipn.TCPPortHandler{5432: {TCPForward: "127.0.0.1:5432"}},
},
},
},
want: strings.Join([]string{
"https://foo.test.ts.net (Funnel on)",
"|-- / proxy http://127.0.0.1:3000",
"",
"tcp://db.test.ts.net:5432 (tailnet only) (svc:db)",
"|--> tcp://127.0.0.1:5432",
"",
"",
}, "\n"),
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
var stdout, stderr bytes.Buffer
tstest.Replace(t, &Stdout, io.Writer(&stdout))
tstest.Replace(t, &Stderr, io.Writer(&stderr))
if err := printServeStatusTrees(tt.sc, statusTestStatus); err != nil {
t.Fatalf("printServeStatusTrees: %v", err)
}
if got := stdout.String(); got != tt.want {
t.Errorf("\nGot:\n%q\nExpected:\n%q", got, tt.want)
}
if got := stderr.String(); got != "" {
t.Errorf("unexpected Stderr output: %q", got)
}
})
}
}
// TestPrintServeStatusTreesParity asserts that the host-identifying keys
// visible in the JSON serialization of a ServeConfig also appear in the
// human-readable output, so the two views stay in lockstep. This is the
// parity contract from issue #34163.
//
// It checks:
// - every Services key (service name)
// - every node-level Web HostPort host
// - every service-level Web HostPort host
// - every node-level TCP forward as a host:port string
// - every tun-mode service rendering the "tun" marker after its name
func TestPrintServeStatusTreesParity(t *testing.T) {
sc := &ipn.ServeConfig{
TCP: map[uint16]*ipn.TCPPortHandler{
443: {HTTPS: true},
2222: {TCPForward: "127.0.0.1:22"},
},
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"foo.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/": {Proxy: "http://127.0.0.1:3000"},
}},
},
AllowFunnel: map[ipn.HostPort]bool{
"foo.test.ts.net:2222": true,
},
Services: map[tailcfg.ServiceName]*ipn.ServiceConfig{
"svc:db": {
TCP: map[uint16]*ipn.TCPPortHandler{5432: {TCPForward: "127.0.0.1:5432"}},
},
"svc:web": {
TCP: map[uint16]*ipn.TCPPortHandler{443: {HTTPS: true}},
Web: map[ipn.HostPort]*ipn.WebServerConfig{
"web.test.ts.net:443": {Handlers: map[string]*ipn.HTTPHandler{
"/api": {Proxy: "http://127.0.0.1:9000"},
}},
},
},
"svc:vpn": {Tun: true},
},
}
// Marshal to JSON and reparse as a generic map so the parity check walks
// the same wire shape clients see, not the typed Go values.
jsonBytes, err := json.Marshal(sc)
if err != nil {
t.Fatalf("json.Marshal: %v", err)
}
var raw map[string]any
if err := json.Unmarshal(jsonBytes, &raw); err != nil {
t.Fatalf("json.Unmarshal: %v", err)
}
var stdout, stderr bytes.Buffer
tstest.Replace(t, &Stdout, io.Writer(&stdout))
tstest.Replace(t, &Stderr, io.Writer(&stderr))
if err := printServeStatusTrees(sc, statusTestStatus); err != nil {
t.Fatalf("printServeStatusTrees: %v", err)
}
if got := stderr.String(); got != "" {
t.Errorf("unexpected Stderr output: %q", got)
}
human := stdout.String()
services, _ := raw["Services"].(map[string]any)
for name, sval := range services {
if !strings.Contains(human, name) {
t.Errorf("human output missing service name %q\n--- human ---\n%s", name, human)
}
svc, _ := sval.(map[string]any)
if tun, _ := svc["Tun"].(bool); tun {
tunLine := "tun (L3 forwarding) (" + name + ")"
if !strings.Contains(human, tunLine) {
t.Errorf("human output missing tun marker for %q\n--- human ---\n%s", tunLine, human)
}
}
web, _ := svc["Web"].(map[string]any)
for hp := range web {
host := strings.SplitN(hp, ":", 2)[0]
if !strings.Contains(human, host) {
t.Errorf("human output missing service %s Web host %q\n--- human ---\n%s", name, host, human)
}
}
}
if web, ok := raw["Web"].(map[string]any); ok {
for hp := range web {
host := strings.SplitN(hp, ":", 2)[0]
if !strings.Contains(human, host) {
t.Errorf("human output missing node Web host %q\n--- human ---\n%s", host, human)
}
}
}
nodeHost := strings.TrimSuffix(statusTestStatus.Self.DNSName, ".")
if tcp, ok := raw["TCP"].(map[string]any); ok {
for portStr, hVal := range tcp {
h, _ := hVal.(map[string]any)
fwd, _ := h["TCPForward"].(string)
if fwd == "" {
continue
}
hostport := net.JoinHostPort(nodeHost, portStr)
if !strings.Contains(human, hostport) {
t.Errorf("human output missing node TCP forward %q\n--- human ---\n%s", hostport, human)
}
}
}
}