fix(ssh): forward custom DERP map to ProxyCommand

cmd/tailcat/ssh.go

@@ -17,6 +17,7 @@ import (
 	"strings"
 	"syscall"
 
+	"github.com/tailscale/tailcat"
 	"tailscale.com/types/logger"
 )
 
@@ -63,14 +64,25 @@ func clientSSHMode(logf logger.Logf) {
 		"-o", "StrictHostKeyChecking no",
 		"-o", "UserKnownHostsFile /dev/null",
 		"-o", "LogLevel ERROR",
-		"-o", fmt.Sprintf("ProxyCommand=%s --key=%q %s %s", exe, *flagKey, connBlobStr, portOrIPPort),
+		"-o", "ProxyCommand=" + sshProxyCommand(exe, *flagKey, *flagDERPMapURL, connBlobStr, portOrIPPort),
 		sshDst,
 	}
 	argv = append(argv, cmdArgs...)
 	err = syscall.Exec(sshExe, argv, os.Environ())
 	log.Fatalf("failed to exec: %v", err)
 }
 
+// sshProxyCommand returns the command passed to OpenSSH to connect the SSH
+// client to a tailcat server. The command is run by OpenSSH, so values that
+// can contain shell-special characters must be quoted.
+func sshProxyCommand(exe, keyName, derpMapURL, connBlob, portOrIPPort string) string {
+	cmd := fmt.Sprintf("%s --key=%q", exe, keyName)
+	if derpMapURL != tailcat.DefaultDERPMapURL {
+		cmd += fmt.Sprintf(" --derpmap-url=%q", derpMapURL)
+	}
+	return fmt.Sprintf("%s %s %s", cmd, connBlob, portOrIPPort)
+}
+
 // sshDestHost returns the hostname to give the system ssh client as the
 // connection destination for a tailcat ConnBlob. It is a short, deterministic
 // function of blob rather than blob itself.

cmd/tailcat/ssh_test.go

@@ -8,8 +8,32 @@ package main
 import (
 	"strings"
 	"testing"
+
+	"github.com/tailscale/tailcat"
 )
 
+func TestSSHProxyCommandDERPMap(t *testing.T) {
+	const (
+		exe  = "/path/to/tailcat"
+		key  = "client-default"
+		blob = "tc-short-blob"
+		port = "22"
+		url  = "https://derp.example.com/derpmap.json"
+	)
+
+	got := sshProxyCommand(exe, key, url, blob, port)
+	want := exe + ` --key="client-default" --derpmap-url="https://derp.example.com/derpmap.json" tc-short-blob 22`
+	if got != want {
+		t.Errorf("sshProxyCommand with custom DERP map = %q; want %q", got, want)
+	}
+
+	got = sshProxyCommand(exe, key, tailcat.DefaultDERPMapURL, blob, port)
+	want = exe + ` --key="client-default" tc-short-blob 22`
+	if got != want {
+		t.Errorf("sshProxyCommand with default DERP map = %q; want %q", got, want)
+	}
+}
+
 func TestSSHDestHost(t *testing.T) {
 	// A realistic ConnBlob, taken from an existing test fixture elsewhere
 	// in this package.