cmd/tailscale: make status show health check problems

Fixes #2775

RELNOTE=tailscale status now shows health check problems

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/tailscale/cli/status.go

@@ -122,10 +122,18 @@ func runStatus(ctx context.Context, args []string) error {
 	case ipn.NeedsMachineAuth.String():
 		fmt.Println("Machine is not yet authorized by tailnet admin.")
 		os.Exit(1)
-	case ipn.Running.String():
+	case ipn.Running.String(), ipn.Starting.String():
 		// Run below.
 	}
 
+	if len(st.Health) > 0 {
+		fmt.Printf("# Health check:\n")
+		for _, m := range st.Health {
+			fmt.Printf("#     - %s\n", m)
+		}
+		fmt.Println()
+	}
+
 	var buf bytes.Buffer
 	f := func(format string, a ...interface{}) { fmt.Fprintf(&buf, format, a...) }
 	printPS := func(ps *ipnstate.PeerStatus) {

health/health.go

@@ -9,6 +9,7 @@ package health
 import (
 	"errors"
 	"fmt"
+	"os"
 	"sort"
 	"sync"
 	"sync/atomic"
@@ -265,6 +266,8 @@ func OverallError() error {
 	return overallErrorLocked()
 }
 
+var fakeErrForTesting = os.Getenv("TS_DEBUG_FAKE_HEALTH_ERROR")
+
 func overallErrorLocked() error {
 	if !anyInterfaceUp {
 		return errors.New("network down")
@@ -315,6 +318,9 @@ func overallErrorLocked() error {
 	for regionID, problem := range derpRegionHealthProblem {
 		errs = append(errs, fmt.Errorf("derp%d: %v", regionID, problem))
 	}
+	if e := fakeErrForTesting; len(errs) == 0 && e != "" {
+		return errors.New(e)
+	}
 	sort.Slice(errs, func(i, j int) bool {
 		// Not super efficient (stringifying these in a sort), but probably max 2 or 3 items.
 		return errs[i].Error() < errs[j].Error()