diff options
| author | Brad Fitzpatrick <bradfitz@tailscale.com> | 2022-05-07 15:04:21 -0700 |
|---|---|---|
| committer | Brad Fitzpatrick <bradfitz@tailscale.com> | 2022-05-07 20:38:20 -0700 |
| commit | a37bcc4f89fbcd4db980da2cd12fa473dd16af93 (patch) | |
| tree | 934f91296eee2b54febf0e079e392c1c61535994 /wgengine/netstack | |
| parent | 741ae9956e674177687062b5499a80db83505076 (diff) | |
| download | tailscale-bradfitz/dot.tar.xz tailscale-bradfitz/dot.zip | |
net/dns: add MagicDNS DNS-over-TLS supportbradfitz/dot
For Android Private DNS in "Automatic" (opportunistic) mdoe.
Tested with:
$ sudo apt-get install knot-dnsutils
$ kdig @100.100.100.100 +tls google.com
Updates #915
Change-Id: I2d59e2d6698f93384b8b3b833b2a3375145ef5ce
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Diffstat (limited to 'wgengine/netstack')
| -rw-r--r-- | wgengine/netstack/netstack.go | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go index 7e6067b99..d8ebd579d 100644 --- a/wgengine/netstack/netstack.go +++ b/wgengine/netstack/netstack.go @@ -377,7 +377,10 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper) filter.Re // on port 80 & 53. switch p.IPProto { case ipproto.TCP: - if port := p.Dst.Port(); port != 53 && port != 80 { + switch p.Dst.Port() { + case 80, 53, 853: + // Handle below. + default: return filter.Accept } case ipproto.UDP: @@ -386,7 +389,6 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper) filter.Re } } - var pn tcpip.NetworkProtocolNumber switch p.IPVersion { case 4: @@ -771,8 +773,17 @@ func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) { // block until the TCP handshake is complete. c := gonet.NewTCPConn(&wq, ep) - if reqDetails.LocalPort == 53 && (dialIP == magicDNSIP || dialIP == magicDNSIPv6) { - go ns.dns.HandleTCPConn(c, netaddr.IPPortFrom(clientRemoteIP, reqDetails.RemotePort)) + if dialIP == magicDNSIP || dialIP == magicDNSIPv6 { + src := netaddr.IPPortFrom(clientRemoteIP, reqDetails.RemotePort) + switch reqDetails.LocalPort { + case 53: + go ns.dns.HandleTCPConn(c, src) + case 853: + go ns.dns.HandleDNSoverTLSConn(c, src) + default: + ns.logf("[unexpected] TCP connection to service IP on port %d", reqDetails.LocalPort) + c.Close() // should be unreachable + } return } |