summaryrefslogtreecommitdiffhomepage
path: root/derp
AgeCommit message (Collapse)AuthorFilesLines
2025-08-11derp/derphttp: test improvements (#16723)Mike O'Driscoll1-14/+20
Update some logging to help future failures. Improve test shutdown concurrency issues. Fixes #16722 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-07-02derp/derphttp: fix DERP TLS client server name inclusion in URL formJames Tucker2-1/+39
When dialed with just an URL and no node, the recent proxy fixes caused a regression where there was no TLS server name being included. Updates #16222 Updates #16223 Signed-off-by: James Tucker <james@tailscale.com> Co-Authored-by: Jordan Whited <jwhited@tailscale.com>
2025-06-18net/tlsdial: fix TLS cert validation of HTTPS proxiesBrad Fitzpatrick2-1/+36
If you had HTTPS_PROXY=https://some-valid-cert.example.com running a CONNECT proxy, we should've been able to do a TLS CONNECT request to e.g. controlplane.tailscale.com:443 through that, and I'm pretty sure it used to work, but refactorings and lack of integration tests made it regress. It probably regressed when we added the baked-in LetsEncrypt root cert validation fallback code, which was testing against the wrong hostname (the ultimate one, not the one which we were being asked to validate) Fixes #16222 Change-Id: If014e395f830e2f87f056f588edacad5c15e91bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-17derp/derphttp: add error notify for RunWatchConnectionLoop (#16261)Mike O'Driscoll2-6/+82
The caller of client.RunWatchConnectionLoop may need to be aware of errors that occur within loop. Add a channel that notifies of errors to the caller to allow for decisions to be make as to the state of the client. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-06-13net/netcheck: preserve live home DERP through packet lossJames Tucker2-2/+6
During a short period of packet loss, a TCP connection to the home DERP may be maintained. If no other regions emerge as winners, such as when all regions but one are avoided/disallowed as candidates, ensure that the current home region, if still active, is not dropped as the preferred region until it has failed two keepalives. Relatedly apply avoid and no measure no home to ICMP and HTTP checks as intended. Updates tailscale/corp#12894 Updates tailscale/corp#29491 Signed-off-by: James Tucker <james@tailscale.com>
2025-06-10cmd/{derp,derpprobe},prober,derp: add mesh support to derpprobe (#15414)Mike O'Driscoll3-36/+77
Add mesh key support to derpprobe for probing derpers with verify set to true. Move MeshKey checking to central point for code reuse. Fix a bad error fmt msg. Fixes tailscale/corp#27294 Fixes tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-05-22cmd/derper: fix mesh auth for DERP servers (#16061)Simon Law5-15/+136
To authenticate mesh keys, the DERP servers used a simple == comparison, which is susceptible to a side channel timing attack. By extracting the mesh key for a DERP server, an attacker could DoS it by forcing disconnects using derp.Client.ClosePeer. They could also enumerate the public Wireguard keys, IP addresses and ports for nodes connected to that DERP server. DERP servers configured without mesh keys deny all such requests. This patch also extracts the mesh key logic into key.DERPMesh, to prevent this from happening again. Security bulletin: https://tailscale.com/security-bulletins#ts-2025-003 Fixes tailscale/corp#28720 Signed-off-by: Simon Law <sfllaw@tailscale.com>
2025-05-19cmd/derper, net/tlsdial: fix client's self-signed cert validationBrad Fitzpatrick4-3/+37
This fixes the implementation and test from #15208 which apparently never worked. Ignore the metacert when counting the number of expected certs presented. And fix the test, pulling out the TLSConfig setup code into something shared between the real cmd/derper and the test. Fixes #15579 Change-Id: I90526e38e59f89b480629b415f00587b107de10a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07all: remove non-applicable "linux" deps on AndroidBrad Fitzpatrick2-1/+3
Updates #12614 Change-Id: I0e2a18eca3515d3d6206c059110556d2bbbb0c5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-16derp/derphttp: remove ban on websockets dependencyDavid Anderson1-22/+0
The event bus's debug page uses websockets. Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2025-04-08net/{netx,memnet},all: add netx.DialFunc, move memnet Network implBrad Fitzpatrick1-1/+2
This adds netx.DialFunc, unifying a type we have a bazillion other places, giving it now a nice short name that's clickable in editors, etc. That highlighted that my earlier move (03b47a55c7956) of stuff from nettest into netx moved too much: it also dragged along the memnet impl, meaning all users of netx.DialFunc who just wanted netx for the type definition were instead also pulling in all of memnet. So move the memnet implementation netx.Network into memnet, a package we already had. Then use netx.DialFunc in a bunch of places. I'm sure I missed some. And plenty remain in other repos, to be updated later. Updates tailscale/corp#27636 Change-Id: I7296cd4591218e8624e214f8c70dab05fb884e95 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-07cmd/derper, derp/derphttp: support, generate self-signed IP address certsBrad Fitzpatrick1-3/+17
For people who can't use LetsEncrypt because it's banned. Per https://github.com/tailscale/tailscale/issues/11776#issuecomment-2520955317 This does two things: 1) if you run derper with --certmode=manual and --hostname=$IP_ADDRESS we previously permitted, but now we also: * auto-generate the self-signed cert for you if it doesn't yet exist on disk * print out the derpmap configuration you need to use that self-signed cert 2) teaches derp/derphttp's derp dialer to verify the signature of self-signed TLS certs, if so declared in the existing DERPNode.CertName field, which previously existed for domain fronting, separating out the dial hostname from how certs are validates, so it's not overloaded much; that's what it was meant for. Fixes #11776 Change-Id: Ie72d12f209416bb7e8325fe0838cd2c66342c5cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-25cmd/derper: add --socket flag to change unix socket path to tailscaledBrad Fitzpatrick1-4/+13
Fixes #10359 Change-Id: Ide49941c486d29856841016686827316878c9433 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-05all: use new LocalAPI client package locationBrad Fitzpatrick1-1/+2
It was moved in f57fa3cbc30e. Updates tailscale/corp#22748 Change-Id: I19f965e6bded1d4c919310aa5b864f2de0cd6220 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-03derp: tcp-write-timeout=0 should disable write deadline (#14895)Jordan Whited1-0/+8
Updates tailscale/corp#26316 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-02-03derp/derphttp,ipn/localapi,net/captivedetection: add cache resistance to ↵James Tucker1-1/+2
captive portal detection Observed on some airlines (British Airways, WestJet), Squid is configured to cache and transform these results, which is disruptive. The server and client should both actively request that this is not done by setting Cache-Control headers. Send a timestamp parameter to further work against caches that do not respect the cache-control headers. Updates #14856 Signed-off-by: James Tucker <james@tailscale.com>
2025-01-24cmd/derper,derp: make TCP write timeout configurablePercy Wegmann1-3/+16
The timeout still defaults to 2 seconds, but can now be changed via command-line flag. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-24derp: move Conn interface to derp.goPercy Wegmann2-12/+12
This interface is used both by the DERP client as well as the server. Defining the interface in derp.go makes it clear that it is shared. Updates tailscale/corp#26045 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-23derp,wgengine/magicsock: remove unexpected label (#14711)Mike O'Driscoll1-4/+3
Remove "unexpected" labelling of PeerGoneReasonNotHere. A peer being no longer connected to a DERP server is not an unexpected case and causes confusion in looking at logs. Fixes tailscale/corp#25609 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-01-20derp: add bytes dropped metric (#14698)Mike O'Driscoll1-5/+30
Add bytes dropped counter metric by reason and kind. Fixes tailscale/corp#25918 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-01-16derp: change packets_dropped metric to also have reason and kind labels (#14651)Mario Minardi2-131/+126
Metrics currently exist for dropped packets by reason, and total received packets by kind (e.g., `disco` or `other`), but relating these two together to gleam information about the drop rate for specific reasons on a per-kind basis is not currently possible. Change `derp_packets_dropped` to use a `metrics.MultiLabelMap` to track both the `reason` and `kind` in the same metric to allow for this desired level of granularity. Drop metrics that this makes unnecessary (namely `packetsDroppedReason` and `packetsDroppedType`). Updates https://github.com/tailscale/corp/issues/25489 Signed-off-by: Mario Minardi <mario@tailscale.com>
2024-12-10prober,derp/derphttp: make dev-mode DERP probes work without TLS (#14347)Mario Minardi1-0/+3
Make dev-mode DERP probes work without TLS. Properly dial port `3340` when not using HTTPS when dialing nodes in `derphttp_client`. Skip verifying TLS state in `newConn` if we are not running a prober. Updates tailscale/corp#24635 Signed-off-by: Percy Wegmann <percy@tailscale.com> Co-authored-by: Percy Wegmann <percy@tailscale.com>
2024-12-10derp: add env var setting server send queue depth (#14334)Mike O'Driscoll2-5/+46
Use envknob to configure the per client send queue depth for the derp server. Fixes tailscale/corp#24978 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2024-11-07derp/derphttp: don't link websockets other than on GOOS=jsBrad Fitzpatrick4-2/+37
Or unless the new "ts_debug_websockets" build tag is set. Updates #1278 Change-Id: Ic4c4f81c1924250efd025b055585faec37a5491d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-20derp: track client-advertised non-ideal DERP connections in more placesBrad Fitzpatrick4-6/+35
In f77821fd63 (released in v1.72.0), we made the client tell a DERP server when the connection was not its ideal choice (the first node in its region). But we didn't do anything with that information until now. This adds a metric about how many such connections are on a given derper, and also adds a bit to the PeerPresentFlags bitmask so watchers can identify (and rebalance) them. Updates tailscale/corp#372 Change-Id: Ief8af448750aa6d598e5939a57c062f4e55962be Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-18derp: add sclient write deadline timeout metric (#13831)Jordan Whited1-0/+6
Write timeouts can be indicative of stalled TCP streams. Understanding changes in the rate of such events can be helpful in an ops context. Updates tailscale/corp#23668 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-10-18derp: give trusted mesh peers longer write timeoutsBrad Fitzpatrick1-1/+14
Updates tailscale/corp#24014 Change-Id: I700872be48ab337dce8e11cabef7f82b97f0422a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-07derp: fix omitted word in commentBrad Fitzpatrick1-1/+1
Fix comment just added in 38f236c7259. Updates tailscale/corp#23668 Updates #cleanup Change-Id: Icbe112e24fcccf8c61c759c631ad09f3e5480547 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-10-07derp: add server metric for batch write sizesBrad Fitzpatrick1-2/+9
Updates tailscale/corp#23668 Change-Id: Ie6268c4035a3b29fd53c072c5793e4cbba93d031 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-24derp: document the RunWatchConnectionLoop callback gotchasBrad Fitzpatrick2-2/+15
Updates #13566 Change-Id: I497b5adc57f8b1b97dbc3f74c0dc67140caad436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-16derp: refactor DERP server's peer-gone watch mechanismBrad Fitzpatrick1-53/+97
In prep for upcoming flow tracking & mutex contention optimization changes, this change refactors (subjectively simplifying) how the DERP Server accounts for which peers have written to which other peers, to be able to send PeerGoneReasonDisconnected messages to writes to uncache their DRPO (DERP Return Path Optimization) routes. Notably, this removes the Server.sentTo field which was guarded by Server.mu and checked on all packet sends. Instead, the accounting is moved to each sclient's sendLoop goroutine and now only needs to acquire Server.mu for newly seen senders, the first time a peer sends a packet to that sclient. This change reduces the number of reasons to acquire Server.mu per-packet from two to one. Removing the last one is the subject of an upcoming change. Updates #3560 Updates #150 Change-Id: Id226216d6629d61254b6bfd532887534ac38586c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-12derp: add new concurrent server benchmarkBrad Fitzpatrick2-0/+68
In prep for reducing mutex contention on Server.mu. Updates #3560 Change-Id: Ie95e7c6dc9f4b64b6f79b3b2338f8cd86c688d98 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-11util/slicesx: add FirstElementEqual and LastElementEqualBrad Fitzpatrick1-1/+2
And update a few callers as examples of motivation. (there are a couple others, but these are the ones where it's prettier) Updates #cleanup Change-Id: Ic8c5cb7af0a59c6e790a599136b591ebe16d38eb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-09-11derp: unify server's clientSet interface into concrete typeBrad Fitzpatrick2-99/+169
73280595a8880bdca for #2751 added a "clientSet" interface to distinguish the two cases of a client being singly connected (the common case) vs tolerating multiple connections from the client at once. At the time (three years ago) it was kinda an experiment and we didn't know whether it'd stop the reconnect floods we saw from certain clients. It did. So this promotes it to a be first-class thing a bit, removing the interface. The old tests from 73280595a were invaluable in ensuring correctness while writing this change (they failed a bunch). But the real motivation for this change is that it'll permit a future optimization to add flow tracking for stats & performance where we don't contend on Server.mu for each packet sent via DERP. Instead, each client can track its active flows and hold on to a *clientSet and ask the clientSet per packet what the active client is via one atomic load rather than a mutex. And if the atomic load returns nil, we'll know we need to ask the server to see if they died and reconnected and got a new clientSet. But that's all coming later. Updates #3560 Change-Id: I9ccda3e5381226563b5ec171ceeacf5c210e1faf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-08-14go.{mod,sum}: migrate from nhooyr.io/websocket to github.com/coder/websocketKyle Carberry1-1/+1
Coder has just adopted nhooyr/websocket which unfortunately changes the import path. `github.com/coder/coder` imports `tailscale.com/net/wsconn` which was still pointing to `nhooyr.io/websocket`, but this change updates it. See https://coder.com/blog/websocket Updates #13154 Change-Id: I3dec6512472b14eae337ae22c5bcc1e3758888d5 Signed-off-by: Kyle Carberry <kyle@carberry.com>
2024-08-06cmd/derper: move 204 handler from package main to derphttpBrad Fitzpatrick1-0/+27
Updates #13038 Change-Id: I28a8284dbe49371cae0e9098205c7c5f17225b40 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-07-17derp/derphttp: determine whether a region connect was to non-ideal nodeBrad Fitzpatrick1-0/+14
... and then do approximately nothing with that information, other than a big TODO. This is mostly me relearning this code and leaving breadcrumbs for others in the future. Updates #12724 Signed-off-by: Brad Fitzpatrick <brad@danga.com>
2024-07-10all: add test for package comments, fix, add comments as neededBrad Fitzpatrick2-0/+3
Updates #cleanup Change-Id: Ic4304e909d2131a95a38b26911f49e7b1729aaef Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-28derp/xdp: retain the link so that the fd is not closedJames Tucker1-2/+10
BPF links require that the owning FD remains open, this FD is embedded into the RawLink returned by the attach function and must live for the duration of the server. Updates ENG-4274 Signed-off-by: James Tucker <james@tailscale.com>
2024-06-26cmd/derper: clarify that derper and tailscaled need to be in syncBrad Fitzpatrick1-0/+4
Fixes #12617 Change-Id: Ifc87b7d9cf699635087afb57febd01fb9a6d11b7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-25derp: make RunConnectionLoop funcs take Messages, support PeerPresentFlagsBrad Fitzpatrick3-24/+24
PeerPresentFlags was added in 5ffb2668ef but wasn't plumbed through to the RunConnectionLoop. Rather than add yet another parameter (as IP:port was added earlier), pass in the raw PeerPresentMessage and PeerGoneMessage struct values, which are the same things, plus two fields: PeerGoneReasonType for gone and the PeerPresentFlags from 5ffb2668ef. Updates tailscale/corp#17816 Change-Id: Ib19d9f95353651ada90656071fc3656cf58b7987 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-24derp: redo, simplify how mesh update writes are queued/writtenBrad Fitzpatrick1-49/+45
I couldn't convince myself the old way was safe and couldn't lose writes. And it seemed too complicated. Updates tailscale/corp#21104 Change-Id: I17ba7c7d6fd83458a311ac671146a1f6a458a5c1 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-24derp: account for increased size of peerPresent messages in mesh updatesBrad Fitzpatrick1-7/+15
sendMeshUpdates tries to write as much as possible without blocking, being careful to check the bufio.Writer.Available size before writes. Except that regressed in 6c791f7d60fa which made those messages larger, which meants we were doing network I/O with the Server mutex held. Updates tailscale/corp#13945 Change-Id: Ic327071d2e37de262931b9b390cae32084811919 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-22derp: add PeerPresentFlags bitmask to Watch messagesBrad Fitzpatrick4-17/+85
Updates tailscale/corp#17816 Change-Id: Ib5baf6c981a6a4c279f8bbfef02048cfbfb3323b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-19derp: don't verify mesh peers when --verify-clients is setBrad Fitzpatrick1-1/+14
Updates tailscale/corp#20654 Change-Id: I33c7ca3c7a3c4e492797b73c66eefb699376402c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-19derp: fix fmt verb for nodekeysBrad Fitzpatrick1-3/+3
It was hex-ifying the String() form of key.NodePublic, which was already hex. I noticed in some logs: "client 6e6f64656b65793a353537353..." And thought that 6x6x6x6x looked strange. It's "nodekey:" in hex. Updates tailscale/corp#20844 Change-Id: Ib9f2d63b37e324420b86efaa680668a9b807e465 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-06-18cmd/xdpderper,derp/xdp: implement mode that drops STUN packets (#12527)Jordan Whited8-9/+107
This is useful during maintenance as a method for shedding home client load. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-06-17derp: add a verifyClients check to the consistency checkJames Tucker1-0/+25
Only implemented for the local tailscaled variant for now. Updates tailscale/corp#20844 Signed-off-by: James Tucker <james@tailscale.com>
2024-06-17derp/xdp: fix handling of zero value UDP checksums (#12510)Jordan Whited4-1/+49
validate_udp_checksum was previously indeterminate (not zero) at declaration, and IPv4 zero value UDP checksum packets were being passed to the kernel. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2024-06-14derp/xdp,cmd/xdpderper: initial skeleton (#12390)Jordan Whited15-0/+8575
This commit introduces a userspace program for managing an experimental eBPF XDP STUN server program. derp/xdp contains the eBPF pseudo-C along with a Go pkg for loading it and exporting its metrics. cmd/xdpderper is a package main user of derp/xdp. Updates tailscale/corp#20689 Signed-off-by: Jordan Whited <jordan@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.