mirror of
https://github.com/tailscale/tailscale.git
synced 2026-11-04 11:08:53 +09:00
Brendan Creane
e0d95c6d91
The services config file stored one protocol per endpoint, taken from
the back-end proxy URL. An HTTPS listener in front of a plain-HTTP
back-end was exported as "http://", and re-applying that file produced a
plain-HTTP listener. The change from TLS to plaintext was silent.
Target now records the front-end (listener) protocol and the back-end
protocol separately. An endpoint is written as the shorthand
"<front>://<host>:<port>" when the back-end is the front-end's default,
and as {"front": ..., "backend": "<proto>://<host>:<port>"} otherwise.
The loader rejects front/back-end pairs the serve apply path cannot
carry.
Every place where a TLS hop could quietly become a plaintext one now
either keeps TLS or reports what it did:
- get-config exports the listener protocol, so an HTTPS listener
stays HTTPS on re-apply.
- Exports are stamped version 0.0.2. In 0.0.1 files the bare
"https://" shorthand named a TLS back-end. In 0.0.2 it names the
listener. The loader keeps the TLS back-end for a 0.0.1 file and
warns that the file should be re-exported. An older client rejects
a 0.0.2 file instead of misreading it.
- get-config refuses to export a handler the format cannot represent
(text, redirect, extra mount points, non-HTTP proxy schemes). With
--all it skips the service, warns on stderr, and exits nonzero.
- A Unix socket destination accepts only the front-end's default
back-end, because tailscaled speaks plain HTTP or TCP to the socket.
"https+insecure://unix:<path>" is now a parse error.
The exported field conffile.Target.Protocol is renamed to Front and a
Backend field is added. Out-of-tree code that built a Target by field
name needs updating.
Fixes #18381
Updates #19724
Signed-off-by: Brendan Creane <bcreane@gmail.com>