pinokiod 8.2.10 → 8.2.12

package/kernel/anywhere/cli.js

@@ -0,0 +1,100 @@
+const { execFile } = require('child_process')
+const net = require('net')
+const { isDeepStrictEqual } = require('util')
+const { FIRST_PORT, LAST_PORT } = require('./ports')
+
+// All control goes through the pinned, bundled CLI and this explicit endpoint.
+class TailscaleCLI {
+  constructor({ binPath, socketPath }) {
+    this.binPath = binPath
+    this.socketPath = socketPath
+    this.children = new Set()
+  }
+  run(args, { timeout = 10000, onOutput } = {}) {
+    return new Promise((resolve, reject) => {
+      const child = execFile(this.binPath, ['--socket=' + this.socketPath, ...args], {
+        shell: false, windowsHide: true, timeout, maxBuffer: 4 * 1024 * 1024,
+      }, (error, stdout, stderr) => {
+        this.children.delete(child)
+        if (error) {
+          error.message = `tailscale ${args[0]}: ${stderr.trim() || stdout.trim() || error.message}`
+          error.cancelled = !!child.cancelled
+          reject(error)
+        } else resolve(stdout)
+      })
+      this.children.add(child)
+      if (onOutput) {
+        let output = ''
+        child.stdout.on('data', (chunk) => {
+          output += chunk
+          try { if (onOutput) onOutput(output) }
+          catch (error) { onOutput = null; child.kill(); reject(error) }
+        })
+      }
+    })
+  }
+  cancel() {
+    for (const child of this.children) { child.cancelled = true; child.kill() }
+  }
+  async json(args, options) {
+    return JSON.parse(await this.run(args, options))
+  }
+  status(timeout = 10000) { return this.json(['status', '--json'], { timeout }) }
+  async ping() {
+    try {
+      await this.status(2000)
+      return true
+    } catch (error) {
+      // A CLI failure alone says nothing about liveness. Only a missing/refused
+      // endpoint confirms absence; this connection probe sends no API requests.
+      return new Promise((resolve, reject) => {
+        const socket = net.createConnection(this.socketPath)
+        socket.once('connect', () => { socket.destroy(); reject(error) })
+        socket.once('error', (cause) => {
+          if (cause.code === 'ENOENT' || cause.code === 'ECONNREFUSED') resolve(false)
+          else reject(error)
+        })
+        socket.setTimeout(2000, () => { socket.destroy(); reject(error) })
+      })
+    }
+  }
+  setPrefs(hostname) {
+    return this.run(['set', '--hostname=' + hostname, '--accept-dns=false', '--accept-routes=false', '--exit-node='])
+  }
+  up(onUpdate, force = false, hostname = 'pinokio') {
+    let emitted = 0
+    return this.run(['up', '--json', '--timeout=5m', '--hostname=' + hostname,
+      '--accept-dns=false', '--accept-routes=false', '--exit-node=', ...(force ? ['--force-reauth'] : [])], {
+      timeout: 305000,
+      onOutput(output) {
+        // The pinned CLI emits pretty-printed top-level JSON objects.
+        for (const block of (output.match(/^\{[\s\S]*?^\}/gm) || []).slice(emitted)) {
+          emitted += 1
+          onUpdate(JSON.parse(block))
+        }
+      },
+    })
+  }
+  logout() { return this.run(['logout']) }
+  queryFeature() { return this.json(['debug', 'localapi', 'POST', '/localapi/v0/query-feature?feature=serve']) }
+  serveConfig() { return this.json(['serve', 'status', '--json']) }
+  async setServeConfig(desired, current) {
+    current = current || {}
+    for (const [hostPort, web] of Object.entries(desired.Web)) {
+      const port = hostPort.slice(hostPort.lastIndexOf(':') + 1)
+      if (isDeepStrictEqual(current.Web && current.Web[hostPort], web) &&
+          isDeepStrictEqual(current.TCP && current.TCP[port], desired.TCP[port])) continue
+      // Each command reads the latest config and writes with its ETag. The CLI
+      // reports conflicts; never use set-raw/reset, which lose that protection.
+      await this.run(['serve', '--bg', '--https=' + port, web.Handlers['/'].Proxy])
+    }
+    for (const port of Object.keys(current.TCP || {})) {
+      if (!desired.TCP[port] && Number(port) >= FIRST_PORT && Number(port) <= LAST_PORT) {
+        await this.run(['serve', '--https=' + port, 'off'])
+      }
+    }
+    return this.serveConfig()
+  }
+}
+
+module.exports = TailscaleCLI