tsnet,internal/client/tailscale: resolve OAuth into authkeys in tsnet (#17191)
* tsnet,internal/client/tailscale: resolve OAuth into authkeys in tsnet Updates #8403. * internal/client/tailscale: omit OAuth library via build tag Updates #12614. Signed-off-by: Naman Sood <mail@nsood.in>main
Naman Sood
7 months ago
committed by
GitHub
parent
2351cc0d0e
commit
b9cda4bca5
@ -0,0 +1,13 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Code generated by gen.go; DO NOT EDIT.
|
||||
|
||||
//go:build ts_omit_oauthkey
|
||||
|
||||
package buildfeatures |
||||
|
||||
// HasOAuthKey is whether the binary was built with support for modular feature "OAuth secret-to-authkey resolution support".
|
||||
// Specifically, it's whether the binary was NOT built with the "ts_omit_oauthkey" build tag.
|
||||
// It's a const so it can be used for dead code elimination.
|
||||
const HasOAuthKey = false |
||||
@ -0,0 +1,13 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Code generated by gen.go; DO NOT EDIT.
|
||||
|
||||
//go:build !ts_omit_oauthkey
|
||||
|
||||
package buildfeatures |
||||
|
||||
// HasOAuthKey is whether the binary was built with support for modular feature "OAuth secret-to-authkey resolution support".
|
||||
// Specifically, it's whether the binary was NOT built with the "ts_omit_oauthkey" build tag.
|
||||
// It's a const so it can be used for dead code elimination.
|
||||
const HasOAuthKey = true |
||||
@ -0,0 +1,10 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Package oauthkey registers support for OAuth key resolution
|
||||
// if it's not disabled via the ts_omit_oauthkey build tag.
|
||||
// Currently (2025-09-19), tailscaled does not need OAuth key
|
||||
// resolution, only the CLI and tsnet do, so this package is
|
||||
// pulled out separately to avoid linking OAuth packages into
|
||||
// tailscaled.
|
||||
package oauthkey |
||||
@ -0,0 +1,8 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
//go:build !ts_omit_oauthkey
|
||||
|
||||
package oauthkey |
||||
|
||||
import _ "tailscale.com/feature/oauthkey" |
||||
@ -0,0 +1,108 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Package oauthkey registers support for using OAuth client secrets to
|
||||
// automatically request authkeys for logging in.
|
||||
package oauthkey |
||||
|
||||
import ( |
||||
"context" |
||||
"errors" |
||||
"fmt" |
||||
"net/url" |
||||
"strconv" |
||||
"strings" |
||||
|
||||
"golang.org/x/oauth2/clientcredentials" |
||||
"tailscale.com/feature" |
||||
"tailscale.com/internal/client/tailscale" |
||||
) |
||||
|
||||
func init() { |
||||
feature.Register("oauthkey") |
||||
tailscale.HookResolveAuthKey.Set(resolveAuthKey) |
||||
} |
||||
|
||||
// resolveAuthKey either returns v unchanged (in the common case) or, if it
|
||||
// starts with "tskey-client-" (as Tailscale OAuth secrets do) parses it like
|
||||
//
|
||||
// tskey-client-xxxx[?ephemeral=false&bar&preauthorized=BOOL&baseURL=...]
|
||||
//
|
||||
// and does the OAuth2 dance to get and return an authkey. The "ephemeral"
|
||||
// property defaults to true if unspecified. The "preauthorized" defaults to
|
||||
// false. The "baseURL" defaults to https://api.tailscale.com.
|
||||
// The passed in tags are required, and must be non-empty. These will be
|
||||
// set on the authkey generated by the OAuth2 dance.
|
||||
func resolveAuthKey(ctx context.Context, v string, tags []string) (string, error) { |
||||
if !strings.HasPrefix(v, "tskey-client-") { |
||||
return v, nil |
||||
} |
||||
if len(tags) == 0 { |
||||
return "", errors.New("oauth authkeys require --advertise-tags") |
||||
} |
||||
|
||||
clientSecret, named, _ := strings.Cut(v, "?") |
||||
attrs, err := url.ParseQuery(named) |
||||
if err != nil { |
||||
return "", err |
||||
} |
||||
for k := range attrs { |
||||
switch k { |
||||
case "ephemeral", "preauthorized", "baseURL": |
||||
default: |
||||
return "", fmt.Errorf("unknown attribute %q", k) |
||||
} |
||||
} |
||||
getBool := func(name string, def bool) (bool, error) { |
||||
v := attrs.Get(name) |
||||
if v == "" { |
||||
return def, nil |
||||
} |
||||
ret, err := strconv.ParseBool(v) |
||||
if err != nil { |
||||
return false, fmt.Errorf("invalid attribute boolean attribute %s value %q", name, v) |
||||
} |
||||
return ret, nil |
||||
} |
||||
ephemeral, err := getBool("ephemeral", true) |
||||
if err != nil { |
||||
return "", err |
||||
} |
||||
preauth, err := getBool("preauthorized", false) |
||||
if err != nil { |
||||
return "", err |
||||
} |
||||
|
||||
baseURL := "https://api.tailscale.com" |
||||
if v := attrs.Get("baseURL"); v != "" { |
||||
baseURL = v |
||||
} |
||||
|
||||
credentials := clientcredentials.Config{ |
||||
ClientID: "some-client-id", // ignored
|
||||
ClientSecret: clientSecret, |
||||
TokenURL: baseURL + "/api/v2/oauth/token", |
||||
} |
||||
|
||||
tsClient := tailscale.NewClient("-", nil) |
||||
tsClient.UserAgent = "tailscale-cli" |
||||
tsClient.HTTPClient = credentials.Client(ctx) |
||||
tsClient.BaseURL = baseURL |
||||
|
||||
caps := tailscale.KeyCapabilities{ |
||||
Devices: tailscale.KeyDeviceCapabilities{ |
||||
Create: tailscale.KeyDeviceCreateCapabilities{ |
||||
Reusable: false, |
||||
Ephemeral: ephemeral, |
||||
Preauthorized: preauth, |
||||
Tags: tags, |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
authkey, _, err := tsClient.CreateKey(ctx, caps) |
||||
if err != nil { |
||||
return "", err |
||||
} |
||||
return authkey, nil |
||||
} |
||||
@ -0,0 +1,20 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
package tailscale |
||||
|
||||
import ( |
||||
"context" |
||||
|
||||
"tailscale.com/feature" |
||||
) |
||||
|
||||
// HookResolveAuthKey resolves to [oauthkey.ResolveAuthKey] when the
|
||||
// corresponding feature tag is enabled in the build process.
|
||||
//
|
||||
// authKey is a standard device auth key or an OAuth client secret to
|
||||
// resolve into an auth key.
|
||||
// tags is the list of tags being advertised by the client (required to be
|
||||
// provided for the OAuth secret case, and required to be the same as the
|
||||
// list of tags for which the OAuth secret is allowed to issue auth keys).
|
||||
var HookResolveAuthKey feature.Hook[func(ctx context.Context, authKey string, tags []string) (string, error)] |
||||
Loading…
Reference in new issue