From a37bcc4f89fbcd4db980da2cd12fa473dd16af93 Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Sat, 7 May 2022 15:04:21 -0700 Subject: net/dns: add MagicDNS DNS-over-TLS support For Android Private DNS in "Automatic" (opportunistic) mdoe. Tested with: $ sudo apt-get install knot-dnsutils $ kdig @100.100.100.100 +tls google.com Updates #915 Change-Id: I2d59e2d6698f93384b8b3b833b2a3375145ef5ce Signed-off-by: Brad Fitzpatrick --- wgengine/netstack/netstack.go | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'wgengine/netstack/netstack.go') diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go index 7e6067b99..d8ebd579d 100644 --- a/wgengine/netstack/netstack.go +++ b/wgengine/netstack/netstack.go @@ -377,7 +377,10 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper) filter.Re // on port 80 & 53. switch p.IPProto { case ipproto.TCP: - if port := p.Dst.Port(); port != 53 && port != 80 { + switch p.Dst.Port() { + case 80, 53, 853: + // Handle below. + default: return filter.Accept } case ipproto.UDP: @@ -386,7 +389,6 @@ func (ns *Impl) handleLocalPackets(p *packet.Parsed, t *tstun.Wrapper) filter.Re } } - var pn tcpip.NetworkProtocolNumber switch p.IPVersion { case 4: @@ -771,8 +773,17 @@ func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) { // block until the TCP handshake is complete. c := gonet.NewTCPConn(&wq, ep) - if reqDetails.LocalPort == 53 && (dialIP == magicDNSIP || dialIP == magicDNSIPv6) { - go ns.dns.HandleTCPConn(c, netaddr.IPPortFrom(clientRemoteIP, reqDetails.RemotePort)) + if dialIP == magicDNSIP || dialIP == magicDNSIPv6 { + src := netaddr.IPPortFrom(clientRemoteIP, reqDetails.RemotePort) + switch reqDetails.LocalPort { + case 53: + go ns.dns.HandleTCPConn(c, src) + case 853: + go ns.dns.HandleDNSoverTLSConn(c, src) + default: + ns.logf("[unexpected] TCP connection to service IP on port %d", reqDetails.LocalPort) + c.Close() // should be unreachable + } return } -- cgit v1.3-3-g829e