summaryrefslogtreecommitdiffhomepage
path: root/net/dnsfallback
AgeCommit message (Collapse)AuthorFilesLines
2025-06-18net/tlsdial: fix TLS cert validation of HTTPS proxiesBrad Fitzpatrick1-1/+1
If you had HTTPS_PROXY=https://some-valid-cert.example.com running a CONNECT proxy, we should've been able to do a TLS CONNECT request to e.g. controlplane.tailscale.com:443 through that, and I'm pretty sure it used to work, but refactorings and lack of integration tests made it regress. It probably regressed when we added the baked-in LetsEncrypt root cert validation fallback code, which was testing against the wrong hostname (the ultimate one, not the one which we were being asked to validate) Fixes #16222 Change-Id: If014e395f830e2f87f056f588edacad5c15e91bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-16net/netmon: publish events to event busDavid Anderson1-1/+5
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com>
2024-08-05{control,net}: close idle connections of custom transportsAnton Tolchanov1-0/+1
I noticed a few places with custom http.Transport where we are not closing idle connections when transport is no longer used. Updates tailscale/corp#21609 Signed-off-by: Anton Tolchanov <anton@tailscale.com>
2024-07-26net/dnsfallback: set CanPort80 in static DERPMap (#12929)Andrea Gottardo1-24/+48
Updates tailscale/corp#21949 As discussed with @raggi, this PR updates the static DERPMap embedded in the client to reflect the availability of HTTP on the DERP servers run by Tailscale. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-07-26health: introduce captive-portal-detected Warnable (#12707)Andrea Gottardo2-6/+9
Updates tailscale/tailscale#1634 This PR introduces a new `captive-portal-detected` Warnable which is set to an unhealthy state whenever a captive portal is detected on the local network, preventing Tailscale from connecting. ipn/ipnlocal: fix captive portal loop shutdown Change-Id: I7cafdbce68463a16260091bcec1741501a070c95 net/captivedetection: fix mutex misuse ipn/ipnlocal: ensure that we don't fail to start the timer Change-Id: I3e43fb19264d793e8707c5031c0898e48e3e7465 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
2024-04-25tsd, ipnlocal, etc: add tsd.System.HealthTracker, start some plumbingBrad Fitzpatrick1-9/+13
This adds a health.Tracker to tsd.System, accessible via a new tsd.System.HealthTracker method. In the future, that new method will return a tsd.System-specific HealthTracker, so multiple tsnet.Servers in the same process are isolated. For now, though, it just always returns the temporary health.Global value. That permits incremental plumbing over a number of changes. When the second to last health.Global reference is gone, then the tsd.System.HealthTracker implementation can return a private Tracker. The primary plumbing this does is adding it to LocalBackend and its dozen and change health calls. A few misc other callers are also plumbed. Subsequent changes will flesh out other parts of the tree (magicsock, controlclient, etc). Updates #11874 Updates #4136 Change-Id: Id51e73cfc8a39110425b6dc19d18b3975eac75ce Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-11-15net/dnsfallback: add singleflight to recursive resolverAndrew Dunham2-53/+174
This prevents running more than one recursive resolution for the same hostname in parallel, which can use excessive amounts of CPU when called in a tight loop. Additionally, add tests that hit the network (when run with a flag) to test the lookup behaviour. Updates tailscale/corp#15261 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I39351e1d2a8782dd4c52cb04b3bd982eb651c81e
2023-10-16net/dnsfallback: disable recursive resolver for nowBrad Fitzpatrick1-2/+10
It seems to be implicated in a CPU consumption bug that's not yet understood. Disable it until we understand. Updates tailscale/corp#15261 Change-Id: Ia6d0c310da6464dda79a70fc3c18be0782812d3f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-09-29net/dnsfallback: remove net/dnsfallback go:generate lineJames Tucker1-2/+5
We should be able to freely run `./tool/go generate ./...`, but we're continually dodging this particular generator. Instead of constantly dodging it, let's just remove it. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>
2023-09-29go.mod,net/dnsfallback: bump go4.org/netipxJames Tucker1-3/+4
Updates #8043 Signed-off-by: James Tucker <james@tailscale.com>
2023-08-17all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}Brad Fitzpatrick1-1/+1
Updates #8419 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-07-28all: update exp/slices and fix call sitesDavid Anderson1-2/+3
slices.SortFunc suffered a late-in-cycle API breakage. Updates #cleanup Signed-off-by: David Anderson <danderson@tailscale.com>
2023-07-10net/dnsfallback: run recursive resolver and compare resultsAndrew Dunham1-1/+70
When performing a fallback DNS query, run the recursive resolver in a separate goroutine and compare the results returned by the recursive resolver with the results we get from "regular" bootstrap DNS. This will allow us to gather data about whether the recursive DNS resolver works better, worse, or about the same as "regular" bootstrap DNS. Updates #5853 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ifa0b0cc9eeb0dccd6f7a3d91675fe44b3b34bd48
2023-04-20all: avoid repeated default interface lookupsMihai Parparita1-6/+10
On some platforms (notably macOS and iOS) we look up the default interface to bind outgoing connections to. This is both duplicated work and results in logspam when the default interface is not available (i.e. when a phone has no connectivity, we log an error and thus cause more things that we will try to upload and fail). Fixed by passing around a netmon.Monitor to more places, so that we can use its cached interface state. Fixes #7850 Updates #7621 Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-04-17net/dnsfallback: more explicitly pass through logf functionMihai Parparita2-41/+15
Redoes the approach from #5550 and #7539 to explicitly pass in the logf function, instead of having global state that can be overridden. Signed-off-by: Mihai Parparita <mihai@tailscale.com>
2023-03-12various: pass logger.Logf through to more placesAndrew Dunham1-4/+7
Updates #7537 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Id89acab70ea678c8c7ff0f44792d54c7223337c6
2023-03-03util/slicesx: add package for generic slice functions, useAndrew Dunham1-4/+4
Now that we're using rand.Shuffle in a few locations, create a generic shuffle function and use it instead. While we're at it, move the interleaveSlices function to the same package for use. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I0b00920e5b3eea846b6cedc30bd34d978a049fd3
2023-03-02net/dnsfallback: shuffle returned IPsAndrew Dunham1-0/+1
This ensures that we're trying multiple returned IPs, since the DERP servers return the same response to all queries. This should increase the chances that we eventually reach a working IP. Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ie8d4fb93df96da910fae49ae71bf3e402b9fdecc
2023-01-27all: update copyright and license headersWill Norris3-9/+6
This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>
2022-11-04all: remove old +build tagsBrad Fitzpatrick1-1/+0
The //go:build syntax was introduced in Go 1.17: https://go.dev/doc/go1.17#build-lines gofmt has kept the +build and go:build lines in sync since then, but enough time has passed. Time to remove them. Done with: perl -i -npe 's,^// \+build.*\n,,' $(git grep -l -F '+build') Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-09-15refactor: move from io/ioutil to io and os packagesEng Zer Jun1-2/+1
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-09-06net/dnsfallback: allow setting log function (#5550)Andrew Dunham2-10/+38
This broke a test in corp that enforces we don't use the log package. Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2022-09-05net/dnsfallback: cache most recent DERP map on disk (#5545)Andrew Dunham2-6/+264
This is especially helpful as we launch newer DERPs over time, and older clients have progressively out-of-date static DERP maps baked in. After this, as long as the client has successfully connected once, it'll cache the most recent DERP map it knows about. Resolves an in-code comment from @bradfitz Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
2022-07-25all: convert more code to use net/netip directlyBrad Fitzpatrick1-6/+5
perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25all: use various net/netip parse funcs directlyBrad Fitzpatrick1-3/+4
Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-07-25net/netaddr: start migrating to net/netip via new netaddr adapter packageBrad Fitzpatrick2-10/+17
Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-17net/dnsfallback: update from 'go generate'Brad Fitzpatrick1-8/+15
Change-Id: I93e0e6d9a4a471953c1ffef07f32605c5724aed8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-04-13Revert ".github/workflows: work around golang/go#51629"Brad Fitzpatrick2-10/+2
This reverts commit 2a412ac9eeca4d7fca7660543df2dbe80868bf99. Updates #4194 Change-Id: I0098b66b71d20bea301ca79058c1cdd201237dd0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-24net/dnsfallback: do not attempt lookups of IPs.Maisem Ali1-0/+4
Currently if the passed in host is an IP, Lookup still attempts to resolve it with a dns server. This makes it just return the IP directly. Updates tailscale/corp#4475 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-03-17.github/workflows: work around golang/go#51629David Anderson2-2/+10
Incidentally, simplify the go generate CI workflow, by marking the dnsfallback update non-hermetic (so CI will skip it) rather than manually filter it out of `go list`. Updates #4194 Signed-off-by: David Anderson <danderson@tailscale.com>
2021-11-18net/netns: thread logf into control functionsJosh Bleecher Snyder1-1/+1
So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-10-16cmd/cloner: mangle "go:generate" in cloner.goJoe Tsai1-4/+4
The "go generate" command blindly looks for "//go:generate" anywhere in the file regardless of whether it is truly a comment. Prevent this false positive in cloner.go by mangling the string to look less like "//go:generate". Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2021-10-01net/tlsdial: bake in LetsEncrypt's ISRG Root X1 rootBrad Fitzpatrick1-0/+2
We still try the host's x509 roots first, but if that fails (like if the host is old), we fall back to using LetsEncrypt's root and retrying with that. tlsdial was used in the three main places: logs, control, DERP. But it was missing in dnsfallback. So added it there too, so we can run fine now on a machine with no DNS config and no root CAs configured. Also, move SSLKEYLOGFILE support out of DERP. tlsdial is the logical place for that support. Fixes #1609 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-22net/dnsfallback: update static map for new derp11.David Anderson1-4/+4
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-09-05net/dnsfallback: go generate, pick up new DERPsBrad Fitzpatrick1-0/+28
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-09-05net/dnsfallback: run go generate to pick up new derp9s.David Anderson1-0/+14
Signed-off-by: David Anderson <danderson@tailscale.com>
2021-08-05all: gofmt with Go 1.17Josh Bleecher Snyder1-0/+1
This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-08-01net/dnsfallback: re-run go generateBrad Fitzpatrick1-21/+14
2021-07-29net/dnsfallback: add new nodesBrad Fitzpatrick1-0/+21
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-07-19net/dnsfallback: regenerateJosh Bleecher Snyder1-0/+7
Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
2021-06-28ipn, etc: use controlplane.tailscale.comDavid Crawshaw1-1/+1
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2021-06-27net/dnsfallback: don't depend on derpmap.ProdBrad Fitzpatrick4-2/+267
Move derpmap.Prod to a static JSON file (go:generate'd) instead, to make its role explicit. And add a TODO about making dnsfallback use an update-over-time DERP map file instead of a baked-in one. Updates #1264 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-04net/dnsfallback: fix infinite loop and limit number of candidatesBrad Fitzpatrick1-8/+22
Updates #1455 (fixes the DNS spin part, but other things aren't ideal there) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-01control/controlclient, net/{dnscache,dnsfallback}: add DNS fallback mechanismBrad Fitzpatrick1-0/+103
Updates #1405 Updates #1403 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.