You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Alex Chan b7fe1cea9f cmd/tailscale/cli: only print authURLs and device approval URLs once ... This patch fixes several issues related to printing login and device approval URLs, especially when `tailscale up` is interrupted: 1. Only print a login URL that will cause `tailscale up` to complete. Don't print expired URLs or URLs from previous login attempts. 2. Print the device approval URL if you run `tailscale up` after previously completing a login, but before approving the device. 3. Use the correct control URL for device approval if you run a bare `tailscale up` after previously completing a login, but before approving the device. 4. Don't print the device approval URL more than once (or at least, not consecutively). Updates tailscale/corp#31476 Updates #17361 ## How these fixes work This patch went through a lot of trial and error, and there may still be bugs! These notes capture the different scenarios and considerations as we wrote it, which are also captured by integration tests. 1. We were getting stale login URLs from the initial IPN state notification. When the IPN watcher was moved to before Start() in c011369, we mistakenly continued to request the initial state. This is only necessary if you start watching after you call Start(), because you may have missed some notifications. By getting the initial state before calling Start(), we'd get a stale login URL. If you clicked that URL, you could complete the login in the control server (if it wasn't expired), but your instance of `tailscale up` would hang, because it's listening for login updates from a different login URL. In this patch, we no longer request the initial state, and so we don't print a stale URL. 2. Once you skip the initial state from IPN, the following sequence: * Run `tailscale up` * Log into a tailnet with device approval * ^C after the device approval URL is printed, but without approving * Run `tailscale up` again means that nothing would ever be printed. `tailscale up` would send tailscaled the pref `WantRunning: true`, but that was already the case so nothing changes. You never get any IPN notifications, and in particular you never get a state change to `NeedsMachineAuth`. This means we'd never print the device approval URL. In this patch, we add a hard-coded rule that if you're doing a simple up (which won't trigger any other IPN notifications) and you start in the `NeedsMachineAuth` state, we print the device approval message without waiting for an IPN notification. 3. Consider the following sequence: * Run `tailscale up --login-server=<custom server>` * Log into a tailnet with device approval * ^C after the device approval URL is printed, but without approving * Run `tailscale up` again We'd print the device approval URL for the default control server, rather than the real control server, because we were using the `prefs` from the CLI arguments (which are all the defaults) rather than the `curPrefs` (which contain the custom login server). In this patch, we use the `prefs` if the user has specified any settings (and other code will ensure this is a complete set of settings) or `curPrefs` if it's a simple `tailscale up`. 4. Consider the following sequence: you've logged in, but not completed device approval, and you run `down` and `up` in quick succession. * `up`: sees state=NeedsMachineAuth * `up`: sends `{wantRunning: true}`, prints out the device approval URL * `down`: changes state to Stopped * `up`: changes state to Starting * tailscaled: changes state to NeedsMachineAuth * `up`: gets an IPN notification with the state change, and prints a second device approval URL Either URL works, but this is annoying for the user. In this patch, we track whether the last printed URL was the device approval URL, and if so, we skip printing it a second time. Signed-off-by: Alex Chan <alexc@tailscale.com>		7 months ago
..
ffcomplete	all: don't rebind variables in for loops	7 months ago
appcroutes.go	appc,*: publish events for route updates and storage (#17392)	7 months ago
bugreport.go	cmd/tailscale/cli, derp: use client/local instead of deprecated client/tailscale (#17061)	8 months ago
cert.go	feature/featuretags, all: add ts_omit_acme to disable TLS cert support	7 months ago
cli.go	cmd/tailscale/cli,client,ipn: add appc-routes cli command	7 months ago
cli_test.go	cmd/tailscale/cli: remove advertise command (#16592)	9 months ago
configure-jetkvm.go	cmd/tailscale/cli: add "configure jetkvm" subcommand	9 months ago
configure-kube.go	cmd/tailscale/cli: make configure kubeconfig accept Tailscale Services (#16601)	9 months ago
configure-kube_omit.go	cmd/tailscale: define CLI tools to manipulate macOS network and system extensions (#14727)	1 year ago
configure-kube_test.go	cmd/tailscale/cli: make configure kubeconfig accept Tailscale Services (#16601)	9 months ago
configure-synology-cert.go	feature, net/tshttpproxy: pull out support for using proxies as a feature	7 months ago
configure-synology-cert_test.go	feature/featuretags, all: add ts_omit_acme to disable TLS cert support	7 months ago
configure-synology.go	cmd/tailscale: define CLI tools to manipulate macOS network and system extensions (#14727)	1 year ago
configure.go	feature/featuretags, all: add ts_omit_acme to disable TLS cert support	7 months ago
configure_apple-all.go	cmd/tailscale: define CLI tools to manipulate macOS network and system extensions (#14727)	1 year ago
configure_apple.go	cmd/tailscale: fix, test some recent doc inconsistencies	1 year ago
configure_linux-all.go	cmd/tailscale/cli: move systray configuration to tailscale configure (#16817)	9 months ago
configure_linux.go	cmd/tailscale/cli: move systray configuration to tailscale configure (#16817)	9 months ago
debug-capture.go	feature/capture: move packet capture to feature/*, out of iOS + CLI	1 year ago
debug-peer-relay.go	client, cmd/tailscale/cli, feature/relayserver, net/udprelay: implement tailscale debug peer-relay-sessions (#17239)	7 months ago
debug-portmap.go	feature/portmapper: make the portmapper & its debugging tools modular	7 months ago
debug.go	control/controlclient: remove x/net/http2, use net/http	7 months ago
diag.go	feature/featuretags: make CLI connection error diagnostics modular	7 months ago
dns-query.go	cmd/tailscale: clean up dns --help messages (#16306)	10 months ago
dns-status.go	cmd/tailscale: clean up dns --help messages (#16306)	10 months ago
dns.go	cmd/tailscale: clean up dns --help messages (#16306)	10 months ago
down.go	cmd/tailscale/cli: update tailscale down to accept an optional --reason	1 year ago
drive.go	cmd/tailscale: omit the `drive` subcommand in MacOS GUI apps	7 months ago
exitnode.go	cmd/tailscale/cli: show last seen time on status command (#16588)	7 months ago
exitnode_test.go	cmd/tailscale: format empty cities and countries as hyphens (#16495)	10 months ago
file.go	syncs: delete WaitGroup and use sync.WaitGroup.Go in Go 1.25	8 months ago
funnel.go	all: add ts_omit_serve, start making tailscale serve/funnel be modular	7 months ago
id-token.go	cmd/tailscale: add shell tab-completion	2 years ago
ip.go	cmd/tailscale/cli: prefix all --help usages with "tailscale ...", some tidying	2 years ago
licenses.go	cmd/tailscale/cli: prefix all --help usages with "tailscale ...", some tidying	2 years ago
login.go	cmd/tailscale/cli: prefix all --help usages with "tailscale ...", some tidying	2 years ago
logout.go	cmd/tailscale/cli,ipn/ipnlocal: restrict logout when AlwaysOn mode is enabled	10 months ago
maybe_syspolicy.go	util/syspolicy: finish plumbing policyclient, add feature/syspolicy, move global impl	8 months ago
metrics.go	cmd/tailscale: fix, test some recent doc inconsistencies	1 year ago
nc.go	cmd/tailscale: add shell tab-completion	2 years ago
netcheck.go	feature/portmapper: make the portmapper & its debugging tools modular	7 months ago
network-lock.go	util/prompt: add a default and take default in non-interactive cases	7 months ago
ping.go	cmd/tailscale/cli, derp: use client/local instead of deprecated client/tailscale (#17061)	8 months ago
risks.go	util/prompt: add a default and take default in non-interactive cases	7 months ago
serve_legacy.go	all: add ts_omit_serve, start making tailscale serve/funnel be modular	7 months ago
serve_legacy_test.go	cmd/tailscale/cli, derp: use client/local instead of deprecated client/tailscale (#17061)	8 months ago
serve_v2.go	util/prompt: add a default and take default in non-interactive cases	7 months ago
serve_v2_test.go	cmd/tailscale/cli: add advertise command to advertise a node as service proxy to tailnet (#16620)	9 months ago
set.go	feature/clientupdate: move clientupdate to a modular feature, disabled for tsnet	7 months ago
set_test.go	cmd/tailscale/cli: prevent all dup flags, not just strings	1 year ago
ssh.go	cmd/tailscale: allow SSH to IPs or DNS names without MagicDNS (#16591)	9 months ago
ssh_exec.go	all: update copyright and license headers	3 years ago
ssh_exec_js.go	all: update copyright and license headers	3 years ago
ssh_exec_windows.go	all: update copyright and license headers	3 years ago
ssh_unix.go	types/logger, cmd/tailscale/cli: flesh out, simplify some non-unix build tags	3 years ago
status.go	cmd/tailscale/cli: use tabwriter for tailscale status (#16596)	7 months ago
switch.go	cmd/tailscale/cli: use helper function for matching profiles	7 months ago
syspolicy.go	util/syspolicy: finish adding ts_omit_syspolicy build tags, tests	8 months ago
systray.go	cmd/tailscale/cli: move systray configuration to tailscale configure (#16817)	9 months ago
systray_omit.go	cmd/tailscale: add systray subcommand on Linux builds	9 months ago
up.go	cmd/tailscale/cli: only print authURLs and device approval URLs once	7 months ago
up_test.go	cmd/tailscale: shrink QR codes using half blocks (#17084)	7 months ago
update.go	util/prompt: add a default and take default in non-interactive cases	7 months ago
version.go	cmd/tailscale/cli: prefix all --help usages with "tailscale ...", some tidying	2 years ago
web.go	cmd/tailscale, ipn/ipnlocal: add ts_omit_webclient	8 months ago
web_test.go	client/web: extract web client from cli package	3 years ago
whois.go	proxymap, various: distinguish between different protocols	2 years ago