lzc256
/
tailscale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

control/controlhttp: use secure WebSockets protocol by default 

Forcing the insecure protocol (and perserving the port number) is only
desired for localhost testing, in prod we need to use wss:// to avoid
mixed-content errors.

Signed-off-by: Mihai Parparita <mihai@tailscale.com>
pull/4825/head
Mihai Parparita 2022-06-08 14:56:52 -07:00 committed by Mihai Parparita
parent 32c6823cf5
commit 2990c2b1cf
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
control/controlhttp/client_js.go
View File

@ -16,7 +16,7 @@ import (
"tailscale.com/types/key" "tailscale.com/types/key"
) )
// Variant of Dial that tunnels the request over WebScokets, since we cannot do // Variant of Dial that tunnels the request over WebSockets, since we cannot do
// bi-directional communication over an HTTP connection when in JS. // bi-directional communication over an HTTP connection when in JS.
func Dial(ctx context.Context, addr string, machineKey key.MachinePrivate, controlKey key.MachinePublic, protocolVersion uint16, dialer dnscache.DialContextFunc) (*controlbase.Conn, error) { func Dial(ctx context.Context, addr string, machineKey key.MachinePrivate, controlKey key.MachinePublic, protocolVersion uint16, dialer dnscache.DialContextFunc) (*controlbase.Conn, error) {
init, cont, err := controlbase.ClientDeferred(machineKey, controlKey, protocolVersion) init, cont, err := controlbase.ClientDeferred(machineKey, controlKey, protocolVersion)
@ -24,13 +24,19 @@ func Dial(ctx context.Context, addr string, machineKey key.MachinePrivate, contr
return nil, err return nil, err
} }
host, addr, err := net.SplitHostPort(addr) host, _, err := net.SplitHostPort(addr)
if err != nil { if err != nil {
return nil, err return nil, err
} }
wsScheme := "wss"
wsHost := host
if host == "localhost" {
wsScheme = "ws"
wsHost = addr
}
wsURL := &url.URL{ wsURL := &url.URL{
Scheme: "ws", Scheme: wsScheme,
Host: net.JoinHostPort(host, addr), Host: wsHost,
Path: serverUpgradePath, Path: serverUpgradePath,
// Can't set HTTP headers on the websocket request, so we have to to send // Can't set HTTP headers on the websocket request, so we have to to send
// the handshake via an HTTP header. // the handshake via an HTTP header.