controlclient/direct: fix a race condition accessing auth keys.

Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>

control/controlclient/auto_test.go

@@ -74,10 +74,12 @@ func runSub(t *testing.T, name string, fn func(t *testing.T)) {
 }
 
 func fatal(t *testing.T, args ...interface{}) {
+	t.Helper()
 	t.Fatal("FAILED: ", fmt.Sprint(args...))
 }
 
 func fatalf(t *testing.T, s string, args ...interface{}) {
+	t.Helper()
 	t.Fatalf("FAILED: "+s, args...)
 }
 
@@ -813,7 +815,10 @@ func TestAuthKey(t *testing.T) {
 		c1.Login(nil, 0)
 		c1.waitStatus(t, stateURLVisitRequired)
 
+		c1.direct.mu.Lock()
 		c1.direct.authKey = string(key)
+		c1.direct.mu.Unlock()
+
 		c1.Login(nil, 0)
 		c1.waitStatus(t, stateAuthenticated)
 		c1.waitStatus(t, stateSynchronized)

control/controlclient/direct.go

@@ -257,6 +257,7 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 	persist := c.persist
 	tryingNewKey := c.tryingNewKey
 	serverKey := c.serverKey
+	authKey := c.authKey
 	expired := c.expiry != nil && !c.expiry.IsZero() && c.expiry.Before(c.timeNow())
 	c.mu.Unlock()
 
@@ -330,7 +331,7 @@ func (c *Direct) doLogin(ctx context.Context, t *oauth2.Token, flags LoginFlags,
 	request.Auth.Oauth2Token = t
 	request.Auth.Provider = persist.Provider
 	request.Auth.LoginName = persist.LoginName
-	request.Auth.AuthKey = c.authKey
+	request.Auth.AuthKey = authKey
 	bodyData, err := encode(request, &serverKey, &persist.PrivateMachineKey)
 	if err != nil {
 		return regen, url, err