From 036334e9135037d99679f0a9811c7cd93cbf152d Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Sat, 5 Nov 2022 21:44:33 -0700
Subject: [PATCH] net/netcheck: deflake (maybe) magicsock's TestNewConn

Updates #6207

Change-Id: I51d200d0b42b9a1ef799d0abfc8d4bd871c50cf2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 net/netcheck/netcheck.go      | 9 +++++++++
 net/stun/stuntest/stuntest.go | 2 +-
 tailcfg/derpmap.go            | 3 +++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index f5eae417e..6dff6197c 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -19,6 +19,7 @@ import (
 	"net/netip"
 	"runtime"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -1112,6 +1113,14 @@ func (c *Client) checkCaptivePortal(ctx context.Context, dm *tailcfg.DERPMap, pr
 	}
 
 	node := dm.Regions[preferredDERP].Nodes[0]
+
+	if strings.HasSuffix(node.HostName, tailcfg.DotInvalid) {
+		// Don't try to connect to invalid hostnames. This occurred in tests:
+		// https://github.com/tailscale/tailscale/issues/6207
+		// TODO(bradfitz,andrew-d): how to actually handle this nicely?
+		return false, nil
+	}
+
 	req, err := http.NewRequestWithContext(ctx, "GET", "http://"+node.HostName+"/generate_204", nil)
 	if err != nil {
 		return false, err
diff --git a/net/stun/stuntest/stuntest.go b/net/stun/stuntest/stuntest.go
index 55ad146b4..1b3ae5ba8 100644
--- a/net/stun/stuntest/stuntest.go
+++ b/net/stun/stuntest/stuntest.go
@@ -122,7 +122,7 @@ func DERPMapOf(stun ...string) *tailcfg.DERPMap {
 		node := &tailcfg.DERPNode{
 			Name:     fmt.Sprint(regionID) + "a",
 			RegionID: regionID,
-			HostName: fmt.Sprintf("d%d.invalid", regionID),
+			HostName: fmt.Sprintf("d%d%s", regionID, tailcfg.DotInvalid),
 			IPv4:     ipv4,
 			IPv6:     ipv6,
 			STUNPort: port,
diff --git a/tailcfg/derpmap.go b/tailcfg/derpmap.go
index 41d863b66..998842dcb 100644
--- a/tailcfg/derpmap.go
+++ b/tailcfg/derpmap.go
@@ -144,3 +144,6 @@ type DERPNode struct {
 	// If empty, it's assumed to be the same as the DERP server.
 	STUNTestIP string `json:",omitempty"`
 }
+
+// DotInvalid is a fake DNS TLD used in tests for an invalid hostname.
+const DotInvalid = ".invalid"