ts_control: support plain HTTP control servers

The control client previously required TLS for all control server
connections. This assumptions break when using Go's testcontrol server,
which serves plain HTTP.

Changes:

- ts_control/connect: select HTTP/1.1 over TCP or TLS based on URL
  scheme, making http:// control URLs work
- ts_http_util: change upgrade request from GET to POST to match Go's
  controlhttpserver which requires POST for /ts2021

Co-Authored-By: Nathan Perry <nathan@tailscale.com>

Author: bradfitz

ts_control/Cargo.toml

@@ -51,6 +51,8 @@ async_tokio = ["dep:futures-util", "dep:tokio", "dep:tokio-stream"]
 
 # Allow derp connections to be made without verifying TLS certs. Only for use in tests.
 insecure-derp = ["ts_transport_derp/insecure-for-tests"]
+# Allow control keys to be fetched over plain HTTP1 without TLS. Only for use in tests.
+insecure-keyfetch = []
 
 [lints]
 workspace = true

ts_control/src/tokio/connect.rs

@@ -71,7 +71,7 @@ pub async fn connect(
     control_url: &Url,
     machine_keys: &MachineKeyPair,
 ) -> Result<Http2<BytesBody>, ConnectionError> {
-    let h1_client = ts_http_util::http1::connect_tls(control_url).await?;
+    let h1_client = connect_h1(control_url).await?;
 
     let control_public_key = fetch_control_key(control_url).await?;
 
@@ -94,16 +94,32 @@ pub async fn connect(
     Ok(h2_conn)
 }
 
+/// Connect an HTTP/1.1 client to the control server, using TLS for https://
+/// URLs and plain TCP for http:// URLs.
+async fn connect_h1(url: &Url) -> Result<ts_http_util::Http1<EmptyBody>, ConnectionError> {
+    if url.scheme() == "http" {
+        Ok(ts_http_util::http1::connect_tcp(url).await?)
+    } else {
+        Ok(ts_http_util::http1::connect_tls(url).await?)
+    }
+}
+
 #[tracing::instrument(skip_all, fields(%control_url), ret, err, level = "trace")]
 pub async fn fetch_control_key(control_url: &Url) -> Result<MachinePublicKey, ConnectionError> {
     let mut key_url = control_url.join("/key")?;
+
+    #[cfg(not(feature = "insecure-keyfetch"))]
     key_url.set_scheme("https").unwrap();
 
+    if key_url.scheme() == "http" {
+        tracing::warn!("fetching control key over insecure http");
+    }
+
     key_url
         .query_pairs_mut()
         .extend_pairs([("v", CapabilityVersion::CURRENT.to_string())]);
 
-    let client = ts_http_util::http1::connect_tls::<EmptyBody>(&key_url).await?;
+    let client = connect_h1(&key_url).await?;
     let response = client.get(&key_url, None).await?;
     if !response.status().is_success() {
         let status = response.status();

ts_http_util/src/lib.rs

@@ -97,7 +97,10 @@ pub fn make_upgrade_req(
     protocol: &str,
     extra_headers: impl IntoIterator<Item = (HeaderName, HeaderValue)>,
 ) -> Result<Request<EmptyBody>, Error> {
-    let mut req = Request::get(u.as_str())
+    // Use POST for the upgrade request. Some server implementations accept both
+    // GET and POST, but others (e.g. Go's testcontrol) only accept POST. POST
+    // is what Go's controlhttp client sends, so use it for widest compatibility.
+    let mut req = Request::post(u.as_str())
         .header(HOST, u.host_str().ok_or(Error::InvalidParam)?)
         .header(UPGRADE, protocol)
         .header(CONNECTION, "Upgrade")