pairling 0.2.5 → 0.2.6

package/payload/mac/connectd/cmd/pairling-connectd/main.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"flag"
@@ -23,6 +25,8 @@ import (
 	"dev.pairling/connectd/internal/gateway"
 	runtimecfg "dev.pairling/connectd/internal/runtime"
 	"dev.pairling/connectd/internal/status"
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/tsnet"
 )
 
@@ -37,7 +41,7 @@ func run(args []string) int {
 	home, _ := os.UserHomeDir()
 	appSupport := runtimecfg.DefaultAppSupportRoot(home)
 	defaultStateDir := runtimecfg.DefaultStateDir(home)
-	defaultHostname := runtimecfg.HostnameFromInstallID(runtimecfg.LoadInstallID(appSupport))
+	defaultHostname := runtimecfg.StableHostname(appSupport, defaultStateDir)
 
 	upstreamRaw := fs.String("upstream", "http://127.0.0.1:7773", "Pairling daemon upstream URL")
 	listenAddr := fs.String("listen", ":7773", "tailnet-only service listen address")
@@ -52,6 +56,12 @@ func run(args []string) int {
 	// expiry disabled — no 180-day re-auth cliff, no per-node REST call.
 	// Empty keeps the legacy interactive browser-auth path (back-compat).
 	authKeyTag := fs.String("auth-key-tag", defaultAuthKeyTag(), "tag applied to this node when registering with an auth key")
+	funnelDefault := false
+	switch strings.ToLower(strings.TrimSpace(os.Getenv("PAIRLING_CONNECT_FUNNEL"))) {
+	case "1", "true", "on", "yes":
+		funnelDefault = true
+	}
+	funnelEnabled := fs.Bool("funnel", funnelDefault, "expose a public Tailscale Funnel listener for the pre-pair bootstrap claim (off by default)")
 
 	if err := fs.Parse(args); err != nil {
 		if errors.Is(err, flag.ErrHelp) {
@@ -115,6 +125,9 @@ func run(args []string) int {
 		Mode:         gateway.ExposureModePairlingConnect,
 		Logger:       gatewayLogger{store: statusStore},
 		RateLimiter:  gateway.NewMemoryRateLimiter(20, 5*time.Minute),
+		PeerNodeResolver: tailscalePeerNodeResolver{localClient: func() (whoIsClient, error) {
+			return srv.LocalClient()
+		}},
 	})
 	if err != nil {
 		log.Printf("cannot create gateway: %v", err)
@@ -131,6 +144,61 @@ func run(args []string) int {
 	statusStore.SetListenerRunning(true)
 	go monitorTailnetIPs(ctx, srv, statusStore)
 
+	// Increment 1: optional public Funnel listener for the pre-pair bootstrap
+	// claim, off by default. A SEPARATE handler in ExposureModeFunnelBootstrap,
+	// never the tailnet pairling_connect handler, so the bearer post-pair surface
+	// is structurally unreachable over Funnel. A failure to open is logged and
+	// recorded but does not bring down the tailnet listener.
+	// Increment 8: PSK-required boot precondition. On a funnel-enabled install the
+	// legacy plaintext /pair/claim must be impossible, so refuse to open the
+	// public listener unless PSK is required (the daemon default). A PSK-off
+	// misconfiguration would otherwise risk a secret-on-the-wire claim path.
+	pskRequired := true
+	switch strings.ToLower(strings.TrimSpace(os.Getenv("PAIRLING_PSK_REQUIRED"))) {
+	case "0", "false", "no", "off":
+		pskRequired = false
+	}
+	if *funnelEnabled && !pskRequired {
+		log.Printf("refusing to open funnel listener: PAIRLING_PSK_REQUIRED must be on for a funnel-enabled install")
+	}
+	var funnelServer *http.Server
+	if *funnelEnabled && pskRequired {
+		funnelMacIDHash := ""
+		if id := strings.TrimSpace(runtimecfg.LoadInstallID(appSupport)); id != "" {
+			sum := sha256.Sum256([]byte(id))
+			funnelMacIDHash = hex.EncodeToString(sum[:])
+		}
+		funnelHandler, ferr := gateway.NewHandler(gateway.Options{
+			Upstream:        upstream,
+			MaxBodyBytes:    *maxBodyBytes,
+			Mode:            gateway.ExposureModeFunnelBootstrap,
+			Logger:          gatewayLogger{store: statusStore},
+			FunnelLimiter:   gateway.NewFunnelLimiter(120, 5, 6),
+			FunnelMacIDHash: funnelMacIDHash,
+		})
+		if ferr != nil {
+			log.Printf("cannot create funnel gateway: %v", ferr)
+			return 1
+		}
+		funnelLn, ferr := srv.ListenFunnel("tcp", ":443", tsnet.FunnelOnly())
+		if ferr != nil {
+			statusStore.SetLastError(ferr.Error())
+			log.Printf("cannot start funnel listener: %v", ferr)
+		} else {
+			funnelServer = &http.Server{Handler: funnelHandler, ReadHeaderTimeout: 10 * time.Second}
+			if domains := srv.CertDomains(); len(domains) > 0 {
+				statusStore.SetFunnelHostname(domains[0])
+				log.Printf("pairling-connectd funnel listener open host=%s", domains[0])
+			}
+			go func() {
+				if serr := funnelServer.Serve(funnelLn); serr != nil && !errors.Is(serr, http.ErrServerClosed) {
+					statusStore.SetLastError(serr.Error())
+					log.Printf("funnel server stopped: %v", serr)
+				}
+			}()
+		}
+	}
+
 	log.Printf("pairling-connectd hostname=%s state_dir=%s listen=%s upstream=%s status=%s", *hostname, *stateDir, *listenAddr, upstream.String(), *statusAddr)
 	server := &http.Server{
 		Handler:           handler,
@@ -145,6 +213,7 @@ func run(args []string) int {
 	select {
 	case <-ctx.Done():
 		shutdownHTTPServer(server)
+		shutdownHTTPServer(funnelServer)
 		return 0
 	case err := <-errCh:
 		if err != nil && !errors.Is(err, http.ErrServerClosed) {
@@ -366,12 +435,28 @@ func monitorTailnetIPs(ctx context.Context, srv *tsnet.Server, store *status.Sto
 	ticker := time.NewTicker(2 * time.Second)
 	defer ticker.Stop()
 	update := func() {
+		identity := NodeIdentity{}
+		if lc, err := srv.LocalClient(); err == nil {
+			if lock, err := lc.NetworkLockStatus(ctx); err == nil {
+				store.SetTailnetLockEnabled(lock.Enabled)
+			}
+			if st, err := lc.StatusWithoutPeers(ctx); err == nil {
+				identity = nodeIdentityFromStatus(st)
+				store.SetTailnetIdentity(identity.NodeID, identity.Tags, identity.TailnetIPs)
+			}
+		}
+		if len(identity.TailnetIPs) > 0 {
+			store.SetTailnetIP(identity.TailnetIPs[0])
+			store.SetAuthenticated()
+			return
+		}
 		ip4, _ := srv.TailscaleIPs()
 		if ip4.IsValid() {
 			store.SetTailnetIP(ip4.String())
 			store.SetAuthenticated()
 			return
 		}
+		store.SetTailnetIdentity("", nil, nil)
 		store.SetAuthPending("")
 	}
 	update()
@@ -384,3 +469,67 @@ func monitorTailnetIPs(ctx context.Context, srv *tsnet.Server, store *status.Sto
 		}
 	}
 }
+
+type NodeIdentity struct {
+	NodeID     string
+	Tags       []string
+	TailnetIPs []string
+}
+
+type whoIsClient interface {
+	WhoIs(ctx context.Context, remoteAddr string) (*apitype.WhoIsResponse, error)
+}
+
+type tailscalePeerNodeResolver struct {
+	localClient func() (whoIsClient, error)
+}
+
+func (r tailscalePeerNodeResolver) PeerNodeID(ctx context.Context, remoteAddr string) (string, bool) {
+	if r.localClient == nil {
+		return "", false
+	}
+	lc, err := r.localClient()
+	if err != nil || lc == nil {
+		return "", false
+	}
+	who, err := lc.WhoIs(ctx, remoteAddr)
+	if err != nil {
+		return "", false
+	}
+	return peerNodeIDFromWhoIs(who)
+}
+
+func peerNodeIDFromWhoIs(who *apitype.WhoIsResponse) (string, bool) {
+	if who == nil || who.Node == nil {
+		return "", false
+	}
+	nodeID := strings.TrimSpace(string(who.Node.StableID))
+	if nodeID == "" {
+		return "", false
+	}
+	for _, tag := range who.Node.Tags {
+		if tag == "tag:pairling-phone" {
+			return nodeID, true
+		}
+	}
+	return "", false
+}
+
+func nodeIdentityFromStatus(st *ipnstate.Status) NodeIdentity {
+	if st == nil || st.Self == nil {
+		return NodeIdentity{}
+	}
+	self := st.Self
+	identity := NodeIdentity{NodeID: string(self.ID)}
+	if self.Tags != nil {
+		for _, tag := range self.Tags.All() {
+			identity.Tags = append(identity.Tags, tag)
+		}
+	}
+	for _, ip := range self.TailscaleIPs {
+		if ip.IsValid() {
+			identity.TailnetIPs = append(identity.TailnetIPs, ip.String())
+		}
+	}
+	return identity
+}

package/payload/mac/connectd/cmd/pairling-connectd/peer_identity_test.go

@@ -0,0 +1,86 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"tailscale.com/client/tailscale/apitype"
+	"tailscale.com/tailcfg"
+)
+
+type fakeWhoIsClient struct {
+	addr string
+	resp *apitype.WhoIsResponse
+	err  error
+}
+
+func (f *fakeWhoIsClient) WhoIs(_ context.Context, remoteAddr string) (*apitype.WhoIsResponse, error) {
+	f.addr = remoteAddr
+	return f.resp, f.err
+}
+
+func TestPeerNodeResolverUsesWhoIsRemoteAddr(t *testing.T) {
+	fake := &fakeWhoIsClient{
+		resp: &apitype.WhoIsResponse{
+			Node: &tailcfg.Node{
+				StableID: tailcfg.StableNodeID("nPeerCNTRL"),
+				Tags:     []string{"tag:pairling-phone"},
+			},
+		},
+	}
+	resolver := tailscalePeerNodeResolver{
+		localClient: func() (whoIsClient, error) {
+			return fake, nil
+		},
+	}
+
+	nodeID, ok := resolver.PeerNodeID(context.Background(), "100.64.0.50:12345")
+	if !ok {
+		t.Fatal("resolver should accept tagged peer")
+	}
+	if fake.addr != "100.64.0.50:12345" {
+		t.Fatalf("WhoIs addr = %q", fake.addr)
+	}
+	if nodeID != "nPeerCNTRL" {
+		t.Fatalf("node ID = %q", nodeID)
+	}
+}
+
+func TestWhoIsResolvesPeerStableID(t *testing.T) {
+	nodeID, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+		Node: &tailcfg.Node{
+			StableID: tailcfg.StableNodeID("nPeerCNTRL"),
+			Tags:     []string{"tag:pairling-phone"},
+		},
+	})
+
+	if !ok {
+		t.Fatal("WhoIs peer should resolve")
+	}
+	if nodeID != "nPeerCNTRL" {
+		t.Fatalf("node ID = %q, want nPeerCNTRL", nodeID)
+	}
+}
+
+func TestAssertsGrantedPhoneTagBeforePersist(t *testing.T) {
+	cases := []struct {
+		name string
+		tags []string
+	}{
+		{name: "untagged"},
+		{name: "wrong tag", tags: []string{"tag:pairling-connect"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			nodeID, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+				Node: &tailcfg.Node{
+					StableID: tailcfg.StableNodeID("nPeerCNTRL"),
+					Tags:     tc.tags,
+				},
+			})
+			if ok || nodeID != "" {
+				t.Fatalf("wrongly accepted node ID %q with tags %#v", nodeID, tc.tags)
+			}
+		})
+	}
+}

package/payload/mac/connectd/cmd/pairling-tailnet-mintd/main.go

@@ -0,0 +1,121 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/signal"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func main() {
+	var (
+		secretPath    = flag.String("secret-path", "/Library/Application Support/Pairling/mint/client_secret.json", "OAuth client credential JSON")
+		socketPath    = flag.String("socket-path", "/Library/Application Support/Pairling/run/mintd/mintd.sock", "Unix socket path")
+		statePath     = flag.String("state-path", "/Library/Application Support/Pairling/mint/state.json", "persistent rate-limit state JSON")
+		auditPath     = flag.String("audit-path", "/Library/Application Support/Pairling/mint/audit.jsonl", "audit JSONL path")
+		alertPath     = flag.String("alert-path", "/Library/Application Support/Pairling/run/mintd/alerts.jsonl", "health-readable alert JSONL path")
+		apiBaseURL    = flag.String("api-base-url", "https://api.tailscale.com/api/v2", "Tailscale API base URL")
+		oauthURL      = flag.String("oauth-url", "https://api.tailscale.com/api/v2/oauth/token", "Tailscale OAuth token URL")
+		authorizedUID = flag.Int("authorized-uid", -1, "only this peer uid may request mints")
+	)
+	flag.Parse()
+
+	b, err := NewBroker(BrokerConfig{
+		SecretPath: *secretPath,
+		StatePath:  *statePath,
+		AuditPath:  *auditPath,
+		AlertPath:  *alertPath,
+		OAuthURL:   *oauthURL,
+		APIBaseURL: *apiBaseURL,
+		LockStatus: defaultLockStatus,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	if err := b.ServeUnix(ctx, *socketPath, *authorizedUID); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func defaultLockStatus(ctx context.Context) (bool, error) {
+	if locked, err := lockStatusFromConnectdStatus(ctx, "http://127.0.0.1:7774/status"); err == nil {
+		return locked, nil
+	}
+	return lockStatusFromCandidates(ctx, []string{
+		"/opt/homebrew/bin/tailscale",
+		"/Applications/Tailscale.app/Contents/MacOS/Tailscale",
+		"tailscale",
+	})
+}
+
+func lockStatusFromConnectdStatus(ctx context.Context, statusURL string) (bool, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, statusURL, nil)
+	if err != nil {
+		return false, err
+	}
+	resp, err := (&http.Client{Timeout: 2 * time.Second}).Do(req)
+	if err != nil {
+		return false, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return false, fmt.Errorf("connectd status returned %s", resp.Status)
+	}
+	var body struct {
+		TailnetLockEnabled *bool `json:"tailnet_lock_enabled"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return false, err
+	}
+	if body.TailnetLockEnabled == nil {
+		return false, errors.New("connectd status omitted tailnet_lock_enabled")
+	}
+	return *body.TailnetLockEnabled, nil
+}
+
+func lockStatusFromCandidates(ctx context.Context, candidates []string) (bool, error) {
+	var errs []error
+	for _, bin := range candidates {
+		out, err := exec.CommandContext(ctx, bin, "lock", "status").CombinedOutput()
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", bin, err))
+			continue
+		}
+		text := strings.ToLower(string(out))
+		if strings.Contains(text, "tailscale gui failed to start") {
+			errs = append(errs, fmt.Errorf("%s: gui unavailable", bin))
+			continue
+		}
+		if strings.Contains(text, "not enabled") || strings.Contains(text, "disabled") {
+			return false, nil
+		}
+		if strings.Contains(text, "enabled") {
+			return true, nil
+		}
+		return false, fmt.Errorf("unrecognized tailscale lock status: %q", strings.TrimSpace(string(out)))
+	}
+	return false, errors.New("tailscale lock status unavailable: " + joinErrors(errs))
+}
+
+func joinErrors(errs []error) string {
+	parts := make([]string, 0, len(errs))
+	for _, err := range errs {
+		parts = append(parts, err.Error())
+	}
+	if len(parts) == 0 {
+		return "no candidates"
+	}
+	return strconv.Quote(strings.Join(parts, "; "))
+}