tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	cab5c46481	net/dns: bound how long we block looking for, restarting systemd-resolved Fixes #3537 Change-Id: Iba6a3cde75983490d4072b5341f48dbfa2f997c0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	f93cf6fa03	net/dns: fix checking for wrapped error when attempting to read wsl.conf for Windows WSL2 Fixes https://github.com/tailscale/tailscale/issues/3437 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
David Anderson	124363e0ca	net/dns: detect and decode UTF-16 from wsl.exe earlier. Fixes #3170 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	78b0bd2957	net/dns/resolver: add clientmetrics for DNS Fixes tailscale/corp#1811 Change-Id: I864d11e0332a177e8c5ff403591bff6fec548f5a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	d10cefdb9b	net/dns: require space after nameserver/search parsing resolv.conf Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	9f00510833	net/dns: handle comments in resolv.conf Currently, comments in resolv.conf cause our parser to fail, with error messages like: ParseIP("192.168.0.100 # comment"): unexpected character (at " # comment") Fix that. Noticed while looking through logs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	88b8a09d37	net/dns: make constants for the various DBus strings. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6c82cebe57	health: add a health state for net/dns.OSConfigurator. Lets the systemd-resolved OSConfigurator report health changes for out of band config resyncs. Updates #3327 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4ef3fed100	net/dns: resync config to systemd-resolved when it restarts. Fixes #3327 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cf9169e4be	net/dns: remove unused Config struct element. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	400ed799e6	net/dns: work around old systemd-resolved setLinkDomain length limit Don't set all the *.arpa. reverse DNS lookup domains if systemd-resolved is old and can't handle them. Fixes #3188 Change-Id: I283f8ce174daa8f0a972ac7bfafb6ff393dde41d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	c5d572f371	net/dns: correctly handle NetworkManager-managed DNS that points to resolved. Fixes #3304 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	94fb42d4b2	all: use testingutil.MinAllocsPerRun There are a few remaining uses of testing.AllocsPerRun: Two in which we only log the number of allocations, and one in which dynamically calculate the allocations target based on a different AllocsPerRun run. This also allows us to tighten the "no allocs" test in wgengine/filter. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Denton Gentry	139a6c4c9c	net/dns: detect when resolvconf points to systemd-resolved. There are /etc/resolv.conf files out there where resolvconf wrote the file but pointed to systemd-resolved as the nameserver. We're better off handling those as systemd-resolved. > # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) > # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN > # 127.0.0.53 is the systemd-resolved stub resolver. > # run "systemd-resolve --status" to see details about the actual nameservers. Fixes https://github.com/tailscale/tailscale/issues/3026 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Anderson	a320d70614	net/dns: fall back to copy+delete/truncate if moving to/from /etc/resolv.conf fails. In some containers, /etc/resolv.conf is a bind-mount from outside the container. This prevents renaming to or from /etc/resolv.conf, because it's on a different filesystem from linux's perspective. It also prevents removing /etc/resolv.conf, because doing so would break the bind-mount. If we find ourselves within this environment, fall back to using copy+delete when renaming to /etc/resolv.conf, and copy+truncate when renaming from /etc/resolv.conf. Fixes #3000 Co-authored-by: Denton Gentry <dgentry@tailscale.com> Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	04d24d3a38	net/dns: move directManager function below directManager's definition. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	422ea4980f	net/dns: remove a tiny wrapper function that isn't contributing anything. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maxim Merzhanov	9f954628e5	net/dns: ignore UnknownMethod error in SetLinkDefaultRoute for resolved manager Signed-off-by: Maxim Merzhanov <maksimmerzh@gmail.com>	3 years ago
Maisem Ali	7817ab6b20	net/dns/resolver: set maxDoHInFlight to 1000 on iOS 15+. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Crawshaw	77696579f5	net/dns/resolver: drop dropping log Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	676fb458c3	net/dns/resolver: make hasRDNSBonjourPrefix match shorter queries too Fixes tailscale/corp#2886 Updates tailscale/corp#2820 Updates #2442 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Smitty	b382161fe5	tsdns: don't forward transient DNS errors When a DNS server claims to be unable or unwilling to handle a request, instead of passing that refusal along to the client, just treat it as any other error trying to connect to the DNS server. This prevents DNS requests from failing based on if a server can respond with a transient error before another server is able to give an actual response. DNS requests only failing sometimes is really hard to find the cause of (#1033). Signed-off-by: Smitty <me@smitop.com>	3 years ago
Denton Gentry	d883747d8b	net/dns/resolver: don't forward DNS-SD on all platforms We added the initial handling only for macOS and iOS. With 1.16.0 now released, suppress forwarding DNS-SD on all platforms to test it through the 1.17.x cycle. Updates #2442 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	297d1b7cb6	net/dns/resolver: don't forward DNS-SD queries Updates #2442 Fixes tailscale/corp#2820 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	47044f3af7	net/dns/resolver: fix log prefix The passed in logf already has a "dns: " prefix so they were doubled up.	3 years ago
Brad Fitzpatrick	7634af5c6f	all: gofmt Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Filippo Valsorda	d7ce2be5f4	net/dns/resolver: add unsecured Quad9 resolvers DNSSEC is an availability issue, as recently demonstrated by the Slack issue, with limited security advantage. DoH on the other hand is a critical security upgrade. This change adds DoH support for the non-DNSSEC endpoints of Quad9. https://www.quad9.net/service/service-addresses-and-features#unsec Signed-off-by: Filippo Valsorda <hi@filippo.io>	3 years ago
Denton Gentry	93c2882a2f	wgengine: flush DNS cache after major link change. Windows has a public dns.Flush used in router_windows.go. However that won't work for platforms like Linux, where we need a different flush mechanism for resolved versus other implementations. We're instead adding a FlushCaches method to the dns Manager, which can be made to work on all platforms as needed. Fixes https://github.com/tailscale/tailscale/issues/2132 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maxim Merzhanov	d43fcd2f02	net/dns: fix error wrapping for SetLinkDefaultRoute in resolved Signed-off-by: Maxim Merzhanov <maksimmerzh@gmail.com>	3 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Anderson	bb6fdfb243	net/dns: fix the build on freebsd (missing default case in switch) Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	b3b1c06b3a	net/dns: only restart systemd-resolved if we changed /etc/resolv.conf. Reported on IRC: in an edge case, you can end up with a directManager DNS manager and --accept-dns=false, in which case we should do nothing, but actually end up restarting resolved whenever the netmap changes, even though the user told us to not manage DNS. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	10547d989d	net/dns: exhaustively test DNS selection paths for linux. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c071bcda33	net/dns: relax systemd-resolved detection. Reported on IRC: a resolv.conf that contained two entries for "nameserver 127.0.0.53", which defeated our "is resolved actually in charge" check. Relax that check to allow any number of nameservers, as long as they're all 127.0.0.53. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	39748e9562	net/dns/resolver: authoritatively return NXDOMAIN for reverse zones we own. Fixes #2774 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Emmanuel T Odeke	0daa32943e	all: add (*testing.B).ReportAllocs() to every benchmark This ensures that we can properly track and catch allocation slippages that could otherwise have been missed. Fixes #2748	3 years ago
Brad Fitzpatrick	065c4ffc2c	net/dns: add start of Linux newOSConfigurator tests Only one test case so far. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	09a47ea3f1	net/dns: prep for writing manager_linux tests; pull some stuff out Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
slowy07	ac0353e982	fix: typo spelling grammar Signed-off-by: slowy07 <slowy.arfy@gmail.com>	3 years ago
David Crawshaw	0ac2130590	net/dns: resolveConfExists reading the wrong error Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	36ffd509de	net/dns: avoid Linux PolicyKit GUI dialog during tests Fixes #2672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	a24cee0d67	all: simplify ts_macext build tags Now that we have the easier-to-parse go:build build tags, it is straightforward to simplify them. Yay. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Adrian Dewhurst	8bdf878832	net/dns/resolver: use forwarded dns txid directly Previously, we hashed the question and combined it with the original txid which was useful when concurrent queries were multiplexed on a single local source port. We encountered some situations where the DNS server canonicalizes the question in the response (uppercase converted to lowercase in this case), which resulted in responses that we couldn't match to the original request due to hash mismatches. This includes a new test to cover that situation. Fixes #2597 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Denton Gentry	260b85458c	net/dns: correct log message. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	54e33b511a	net/dns/resolver: add test that I forgot to git add earlier This was meant to be part of `53a2f63658` earlier but I guess I failed at git. Updates #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	be921d1a95	net/dns/resolver: fix skipped DoH test that bitrot Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	881bb8bcdc	net/dns/resolver: allow an extra alloc for go closure allocation Go 1.17 switches to a register ABI on amd64 platforms. Part of that switch is that go and defer calls use an argument-less closure, which allocates. This means that we have an extra alloc in some DNS work. That's unfortunate but not a showstopper, and I don't see a clear path to fixing it. The other performance benefits from the register ABI will all but certainly outweigh this extra alloc. Fixes #2545 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	f414a9cc01	net/dns/resolver: EDNS OPT record off-by-one I don't know how to get access to a real packet. Basing this commit entirely off: +------------+--------------+------------------------------+ \| Field Name \| Field Type \| Description \| +------------+--------------+------------------------------+ \| NAME \| domain name \| MUST be 0 (root domain) \| \| TYPE \| u_int16_t \| OPT (41) \| \| CLASS \| u_int16_t \| requestor's UDP payload size \| \| TTL \| u_int32_t \| extended RCODE and flags \| \| RDLEN \| u_int16_t \| length of all RDATA \| \| RDATA \| octet stream \| {attribute,value} pairs \| +------------+--------------+------------------------------+ From https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	53a2f63658	net/dns/resolver: race well-known resolvers less aggressively Instead of blasting away at all upstream resolvers at the same time, make a timing plan upon reconfiguration and have each upstream have an associated start delay, depending on the overall forwarding config. So now if you have two or four upstream Google or Cloudflare DNS servers (e.g. two IPv4 and two IPv6), we now usually only send a query, not four. This is especially nice on iOS where we start fewer DoH queries and thus fewer HTTP/1 requests (because we still disable HTTP/2 on iOS), fewer sockets, fewer goroutines, and fewer associated HTTP buffers, etc, saving overall memory burstiness. Fixes #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e94ec448a7	net/dns/resolver: add forwardQuery type as race work prep Add a place to hang state in a future change for #2436. For now this just simplifies the send signature without any functional change. Updates #2436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	064b916b1a	net/dns/resolver: fix func used as netaddr.IP in printf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cecfc14875	net/dns: don't build init*.go on non-windows To remove the regexp dep on iOS, notably. Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2968893add	net/dns/resolver: bound DoH usage on iOS Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3daf27eaad	net/dns/resolver: fall back to IPv6 for well-known DoH servers if v4 fails Should help with IPv6-only environments when the tailnet admin only specified IPv4 DNS IPs. See https://github.com/tailscale/tailscale/issues/2447#issuecomment-884188562 Co-Author: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	74eee4de1c	net/dns/resolver: use correct Cloudflare DoH hostnames We were using the wrong ones for the malware & adult content variants. Docs: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https Earlier commit which added them: `236eb4d04d` Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e74d37d30f	net/dns{,/resolver}: quiet DNS output logging It was a huge chunk of the overall log output and made debugging difficult. Omit and summarize the spammy *.arpa parts instead. Fixes tailscale/corp#2066 (to which nobody had opinions, so)	3 years ago
Brad Fitzpatrick	236eb4d04d	net/dns/resolver: upgrade forwarded MagicDNS queries to DoH when IP known Recognize Cloudflare, Google, Quad9 which are by far the majority of upstream DNS servers that people use. RELNOTE=MagicDNS now uses DNS-over-HTTPS when querying popular upstream resolvers, so DNS queries aren't sent in the clear over the Internet. Updates #915 (might fix it?) Updates #988 (gets us closer, if it fixes Android) Updates #74 (not yet configurable, but progress) Updates #2056 (not yet configurable, dup of #74?) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	6b9f8208f4	net/dns: do not run wsl.exe as LocalSystem It doesn't work. It needs to run as the user. https://github.com/microsoft/WSL/issues/4803 The mechanism for doing this was extracted from: https://web.archive.org/web/20101009012531/http://blogs.msdn.com/b/winsdk/archive/2009/07/14/launching-an-interactive-process-from-windows-service-in-windows-vista-and-later.aspx While here, we also reclaculate WSL distro set on SetDNS. This accounts for: 1. potential inability to access wsl.exe on startup 2. WSL being installed while Tailscale is running 3. A new WSL distrobution being installed Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	1147c7fd4f	net/dns: set WSL /etc/resolv.conf We also have to make a one-off change to /etc/wsl.conf to stop every invocation of wsl.exe clobbering the /etc/resolv.conf. This appears to be a safe change to make permanently, as even though the resolv.conf is constantly clobbered, it is always the same stable internal IP that is set as a nameserver. (I believe the resolv.conf clobbering predates the MS stub resolver.) Tested on WSL2, should work for WSL1 too. Fixes #775 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	9b063b86c3	net/dns: factor directManager out over an FS interface This is preliminary work for using the directManager as part of a wslManager on windows, where in addition to configuring windows we'll use wsl.exe to edit the linux file system and modify the system resolv.conf. The pinholeFS is a little funky, but it's designed to work through simple unix tools via wsl.exe without invoking bash. I would not have thought it would stand on its own like this, but it turns out it's useful for writing a test for the directManager. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	72a0b5f042	net/dns/resolver: fmt item This has been bothering me for a while, but everytime I run format from the root directory it also formats this file. I didn't want to add it to my other PRs but it's annoying to have to revert it every time. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
David Crawshaw	80b1308974	net/dns: remove ref to managerImpl Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Adrian Dewhurst	bcaae3e074	net/dns/resolver: clamp EDNS size This change (subject to some limitations) looks for the EDNS OPT record in queries and responses, clamping the size field to fit within our DNS receive buffer. If the size field is smaller than the DNS receive buffer then it is left unchanged. I think we will eventually need to transition to fully processing the DNS queries to handle all situations, but this should cover the most common case. Mostly fixes #2066 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	084d48d22d	net/dns: always proxy through quad-100 on windows 8.1. Windows 8.1 incorrectly handles search paths on an interface with no associated resolver, so we have to provide a full primary DNS config rather than use Windows 8.1's nascent-but-present NRPT functionality. Fixes #2237. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	733d52827b	net/dns/resolver: skip test on macOS Fixes #2229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Anderson	9337826011	net/dns: fix inverted test for NetworkManager version. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	320cc8fa21	net/dns: verify that systemd-resolved is actually in charge. It's possible to install a configuration that passes our current checks for systemd-resolved, without actually pointing to systemd-resolved. In that case, we end up programming DNS in resolved, but that config never applies to any name resolution requests on the system. This is quite a far-out edge case, but there's a simple additional check we can do: if the header comment names systemd-resolved, there should be a single nameserver in resolv.conf pointing to 127.0.0.53. If not, the configuration should be treated as an unmanaged resolv.conf. Fixes #2136. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e7164425b3	net/dns: don't use NetworkManager for DNS on very old NetworkManagers. Fixes #1945. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Dave Anderson	144c68b80b	net/dns: avoid using NetworkManager as much as possible. (#1945 ) Addresses #1699 as best as possible. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Adrian Dewhurst	8b11937eaf	net/dns/resolver: permit larger max responses, signal truncation This raises the maximum DNS response message size from 512 to 4095. This should be large enough for almost all situations that do not need TCP. We still do not recognize EDNS, so we will still forward requests that claim support for a larger response size than 4095 (that will be solved later). For now, when a response comes back that is too large to fit in our receive buffer, we now set the truncation flag in the DNS header, which is an improvement from before but will prompt attempts to use TCP which isn't supported yet. On Windows, WSARecvFrom into a buffer that's too small returns an error in addition to the data. On other OSes, the extra data is silently discarded. In this case, we prefer the latter so need to catch the error on Windows. Partially addresses #1123 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
David Anderson	7fab244614	net/dns/resolver: don't spam logs on EHOSTUNREACH. Fixes #1719. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	cfde997699	net/dns: don't use interfaces.Tailscale to find the tailscale interface index. interfaces.Tailscale only returns an interface if it has at least one Tailscale IP assigned to it. In the resolved DNS manager, when we're called upon to tear down DNS config, the interface no longer has IPs. Instead, look up the interface index on construction and reuse it throughout the daemon lifecycle. Fixes #1892. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	3c8e230ee1	Revert "net/dns: set IPv4 auto mode in NM, so it lets us set DNS." This reverts commit `7d16c8228b`. I have no idea how I ended up here. The bug I was fixing with this change fails to reproduce on Ubuntu 18.04 now, and this change definitely does break 20.04, 20.10, and Debian Buster. So, until we can reliably reproduce the problem this was meant to fix, reverting. Part of #1875 Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	5bd38b10b4	net/dns: log the correct error when NM Reapply fails. Found while debugging #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7d16c8228b	net/dns: set IPv4 auto mode in NM, so it lets us set DNS. Part of #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	77e2375501	net/dns: don't try to configure LLMNR or mdns in NetworkManager. Fixes #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	20e04418ff	net/dns: add GOOS build tags Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
David Anderson	bf9ef1ca27	net/dns: stop NetworkManager breaking v6 connectivity when setting DNS. Tentative fix for #1699 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	44c2b7dc79	net/dns: on windows, skip site-local v6 resolvers. Further refinement for tailscale/corp#1662. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	97d2fa2f56	net/dns: work around WSL DNS implementation flaws. Fixes tailscale/corp#1662 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f6b7d08aea	net/dns: work around new NetworkManager in other selection paths. Further bits of #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	25ce9885a2	net/dns: don't use NM+resolved for NM >=1.26.6. NetworkManager fixed the bug that forced us to use NetworkManager if it's programming systemd-resolved, and in the same release also made NetworkManager ignore DNS settings provided for unmanaged interfaces... Which breaks what we used to do. So, with versions 1.26.6 and above, we MUST NOT use NetworkManager to indirectly program systemd-resolved, but thankfully we can talk to resolved directly and get the right outcome. Fixes #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	30f5d706a1	net/dns/resolver: remove unnecessary/racy WaitGroup. Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89c81c26c5	net/dns: fix resolved match domains when no nameservers are provided. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4be26b269f	net/dns: correctly capture all traffic in non-split configs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ca283ac899	net/dns: remove config in openresolv when given an empty DNS config. Part of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	53213114ec	net/dns: make debian_resolvconf correctly clear DNS configs. More of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3b1ab78954	net/dns: restore resolv.conf when given an empty config in directManager. Fixes #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	158328ba24	net/dns: remove ForceSplitDNSForTesting. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	bb0710d51d	net/dns: add debugging traces to DNS manager selection on linux. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4b70c7b717	net/dns: fix inverted test for NetworkManager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4849a4d3c8	net/dns: error out on linux if /etc/resolv.conf can't be read. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1f9b73a531	net/dns: fix freebsd DNS manager selection. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c2ca2ac8c4	net/dns: fix FreeBSD build Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84bd50329a	net/dns: fix staticheck. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d6bb11b5bf	net/dns: implement correct manager detection on linux. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9ef932517b	net/dns: fix NM's GetBaseConfig when no configs exist. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fe3b1ab747	net/dns: refactor dbus connection setup in resolved manager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	854d5d36a1	net/dns: return error from NewOSManager, use it to initialize NM. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9aa33b43e6	net/dns: support split and unsplit DNS in NetworkManager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	87eb8384f5	net/dns: fix up NetworkManager configurator a bit. Clear LLMNR and mdns flags, update reasoning for our settings, and set our override priority harder than before when we want to be primary resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3d81e6260b	net/dns: set resolved DefaultRoute setting according to split-dns mode. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cca230cc23	net/dns: fix staticcheck errors. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	4b47393e0c	net/dns: pacify staticcheck for now Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	a7340c2015	net/dns: support split DNS in systemd-resolved. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	84430cdfa1	net/dns: improve NetworkManager detection, using more DBus. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9a48bac8ad	net/dns: rename resolvconf.go to debian_resolvconf.go. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9831f1b183	net/dns: also include 'tail' and 'base' files when fixing up resolv.conf. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e43afe9140	net/dns: implement prior config reading for debian resolvconf. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	143e5dd087	net/dns: rename script variable. Debian resolvconf is not legacy, it's alive and well, just historically before the other implementations. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	55b39fa945	net/dns: add documentation to openresolv's config fetch. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	61b361bac0	net/dns: teach the openresolv manager to read DNS config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58760f7b82	net/dns: split resolvconfManager into a debian and an openresolv manager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5480189313	net/dns: implement a DNS override workaround for legacy resolvconf. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e638a4d86b	net/dns: make directManager support split DNS, and work in sandboxes. Fixes #1495, #683. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2685260ba1	net/dns: add temporary fallback to quad-9 resolver for split-DNS testing. This allows split-DNS configurations to not break clients on OSes that haven't yet been ported to understand split DNS, by falling back to quad-9 as a global resolver when handed an "impossible to implement" split-DNS config. Part of #953. Needs to be removed before shipping 1.8. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b9e194c14b	net/dns: add missing FQDN qualification. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b74a8994ca	net/dns: make FQDN dot style consistent in more places. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6def647514	net/dns/resolver: don't avoid tailscale routes for DNS forwarding. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4a64d2a603	net/dns: some post-review cleanups. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	720c1ad0f0	net/dns: insert OS base config when emulating split DNS. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e560be6443	net/dns: sort matchDomains to avoid test flake. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	68f76e9aa1	net/dns: add GetBaseConfig to OSConfigurator interface. Part of #953, required to make split DNS work on more basic platforms. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fe9cd61d71	net/dns: add tests for DNS config generation. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ba6d03768	net/dns/resolver: add a test helper to get at the resolver config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	da4cc8bbb4	net/dns: handle all possible translations of high-level DNS config. With this change, all OSes can sort-of do split DNS, except that the default upstream is hardcoded to 8.8.8.8 pending further plumbing. Additionally, Windows 8-10 can do split DNS fully correctly, without the 8.8.8.8 hack. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e0e677a8f6	net/dns: split out search domains and match domains in OSConfig. It seems that all the setups that support split DNS understand this distinction, and it's an important one when translating high-level configuration. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a8dcda9c9a	net/dns: start of compat hacks for Windows 7. Correctly reports that Win7 cannot do split DNS, and has a helper to discover the "base" resolvers for the system. Part of #953 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3e915ac783	net/dns: implement OS-level split DNS for Windows. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c16a926bf2	net/dns: set OSConfig.Primary. OS implementations are going to support split DNS soon. Until they're all in place, hardcode Primary=true to get the old behavior. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	de6dc4c510	net/dns: add a Primary field to OSConfig. Currently ignored. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b2a597b288	net/dns: rename Set to SetDNS in OSConfigurator. wgengine/router.CallbackRouter needs to support both the Router and OSConfigurator interfaces, so the setters can't both be called Set. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7d84ee6c98	net/dns: unify the OS manager and internal resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1bf91c8123	net/dns/resolver: remove unused err return value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6a206fd0fb	net/dns: rename impl to os. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c4530971db	net/dns/resolver: remove leftover debug print. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4c61ebacf4	wgengine: move DNS configuration out of wgengine/router. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	748670f1e9	net/dns: fix typo in docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a39d2403bc	net/dns: disable NetworkManager and resolved configurators temporarily. They need some rework to do the right thing, in the meantime the direct and resolvconf managers will work out. The resolved implementation was never selected due to control-side settings. The networkmanager implementation mostly doesn't get selected due to unforeseen interactions with `resolvconf` on many platforms. Both implementations also need rework to support the various routing modes they're capable of. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	befd8e4e68	net/dns: replace managerImpl with OSConfigurator in code. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	077d4dc8c7	net/dns: add an OSConfigurator interface. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6ad44f9fdf	wgengine: take in dns.Config, split out to resolver.Config and dns.OSConfig. Stepping stone towards having the DNS package handle the config splitting. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2edb57dbf1	net/dns: add new Config that captures tailscale+OS DNS config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8af9d770cf	net/dns: rename Config to OSConfig. Making way for a new higher level config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fcfc0d3a08	net/dns: remove ManagerConfig, pass relevant args directly. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ca04f1e01	net/dns: put noop.go back, limit with build tags for staticcheck. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	95470c3448	net/dns: remove Cleanup manager parameter. It's only use to skip some optional initialization during cleanup, but that work is very minor anyway, and about to change drastically. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cf361bb9b1	net/dns: remove PerDomain from Config. It's currently unused, and no longer makes sense with the upcoming DNS infrastructure. Keep it in tailcfg for now, since we need protocol compat for a bit longer. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f77ba75d6c	wgengine/router: move DNS cleanup into the DNS package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9f105d3968	net/dns/resolver: teach the forwarder to do per-domain routing. Given a DNS route map, the forwarder selects the right set of upstreams for a given name. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	90f82b6946	net/dns/resolver: add live reconfig, plumb through to ipnlocal. The resolver still only supports a single upstream config, and ipn/wgengine still have to split up the DNS config, but this moves closer to unifying the DNS configs. As a handy side-effect of the refactor, IPv6 MagicDNS records exist now. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	caeafc4a32	net/dns/resolver: fix package docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	dbe4f6f42d	net/dns/resolver: unexport Resolve and ResolveReverse. They're only used internally and in tests, and have surprising semantics in that they only resolve MagicDNS names, not upstream resolver queries. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cdeb8d6816	net/dns/resolver: fix staticcheck error. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f185d62dc8	net/dns/resolver: unexport Packet, only use it internally. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5fb9e00ecf	net/dns/resolver: remove Start method, fully spin up in New instead. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	075fb93e69	net/dns/resolver: remove the Config struct. In preparation for reintroducing a runtime reconfig Config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	bc81dd4690	net/dns/resolver: rename ResolverConfig to just Config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6521f02ff6	Move DNS flush logic to net/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8432999835	Move wgengine/tsdns to net/dns. Straight move+fixup, no other changes. In prep for merging with wgengine/router/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago

... 3 4 5 6 7 ...

377 Commits (40833a752498206b0fe3cb076881343e4bb77dd9)