macOS default socket handling of tailscale and tailscaled are different

[holymonson]

What is the issue?

tailscale claims it's default socket is /var/run/tailscaled.socket, same as tailscaled's, but in fact it dials [::1]:64511.

Steps to reproduce

❯ tailscale help
USAGE
  tailscale [flags] <subcommand> [command flags]

For help on subcommands, add --help after: "tailscale status --help".

This CLI is still under active development. Commands and flags will
change in the future.

SUBCOMMANDS
  up         Connect to Tailscale, logging in if needed
  down       Disconnect from Tailscale
  logout     Disconnect from Tailscale and expire current node key
  netcheck   Print an analysis of local network conditions
  ip         Show Tailscale IP addresses
  status     Show state of tailscaled and its connections
  ping       Ping a host at the Tailscale layer, see how it routed
  nc         Connect to a port on a host, connected to stdin/stdout
  ssh        SSH to a Tailscale machine
  version    Print Tailscale version
  web        Run a web server for controlling Tailscale
  file       Send or receive files
  bugreport  Print a shareable identifier to help diagnose issues
  cert       get TLS certs
  lock       Manipulate the tailnet key authority
  licenses   Get open source license information

FLAGS
  --socket string
    	path to tailscaled's unix socket (default /var/run/tailscaled.socket)

❯ tailscale status
failed to connect to local tailscaled (which appears to be running as tailscaled, pid 22000). Got error: Failed to connect to local Tailscale daemon for /localapi/v0/status; not running? Error: dial tcp [::1]:64511: connect: connection refused
❯ 
❯ tailscale --socket /var/run/tailscaled.socket status
100.105.126.126 monson-mbp-cli       holymonson@  macOS   -
100.94.240.71   dskt                 holymonson@  linux   -
100.95.87.78    zenobia-mba          holymonson@  macOS   -

Are there any recent changes that introduced the issue?

Seems it's introduced by version 1.30.2.

OS

macOS

OS version

macos 12.6

Tailscale version

1.30.2

Bug report

BUG-9d2329911aa0d09a17272bf7484567e965d2956691dcab7aee5a67ecdd98385d-20220927091756Z-0faaddd812048e06

[bradfitz]

On macOS, it first tries the Unix socket and then if that fails it assumes you're trying to connect from the open source CLI to the GUI, which it uses localhost TCP. So if both fail, you'll see that TCP error.

[holymonson]

On macOS, it first tries the Unix socket

As you can see in "Steps to reproduce", it dials /var/run/tailscaled.socket only when specified with --socket.

[holymonson]

@bradfitz I think here is the root cause:

There is a symlink file ipnport -> 64511 in /Library/Tailscale/, tailscaled will ignore it and listen to the default unix socket, while tailscale will follow it to dial to port 64511. Please solve this inconsistency, thanks.

[pkpowell]

This could be related to switching between the AppStore and open source versions. I recently installed the AppStore version and ran into this after uninstalling. Unlinking the ipnport file mentioned above solved this for me.

[DentonGentry]

We should make Tailscaled-on-macOS not use a localhost socket, if it still does.

[bradfitz]

GOOS=darwin tailscaled has always used a Unix socket

[fwl-whu]

This could be related to switching between the AppStore and open source versions. I recently installed the AppStore version and ran into this after uninstalling. Unlinking the ipnport file mentioned above solved this for me.

How to unlink? Just remove the "ipnport"? Thank you!

[pkpowell]

unlink ipnport was the command I used (as root). rm ipnport should also work.

[fwl-whu]

unlink ipnport was the command I used (as root). rm ipnport should also work.

thanks!

[shayne]

I just ran into this (nix-darwin). You'll likely hit this if you're moving between the AppStore version (macsys) and OSS tailscaled.

From the little sleuthing I did, the culprit is

tailscale/safesocket/safesocket_darwin.go

Lines 32 to 33 in 7a82fd8

	const dir = "/Library/Tailscale"
	portStr, err := os.Readlink(filepath.Join(dir, "ipnport"))

If you remove this directory, tailscale will appropriately try /var/run/tailscaled.socket.

Should we instead look at if tailscaled is running on Darwin (vs IPNExtension)?