tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	6feb8f4c51	net/dns: log why resolved does not look like it's on use [Linux] Updates #3742 Updates #3531 Change-Id: I9fc7fa0f4bcab1cf8001ba92408c660a5b25f105 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Bieber	411c6c316c	net/dns/resolvd: store nameservers Currently only search domains are stored. This was an oversight (under?) on my part. As things are now, when MagicDNS is on and "Override local DNS" is off, the dns forwarder has to timeout before names resolve. This introduces a pretty annoying lang that makes everything feel extremely slow. You will also see an error: "upstream nameservers not set". I tested with "Override local DNS" on and off. In both situations things seem to function as expected (and quickly). Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	2 years ago
Brad Fitzpatrick	24a04d07d1	net/dns/resolver: handle tabs as whitespace when ExitDNS parses resolv.conf On Synology, the /etc/resolv.conf has tabs in it, which this resolv.conf parser (we have two, sigh) didn't handle. Updates #3710 Change-Id: I86f8e09ad1867ee32fa211e85c382a27191418ea Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8df3fa4638	net/dns: make WSL network configuration opt-in for now Tailscale seems to be breaking WSL configurations lately. Until we understand what changed, turn off Tailscale's involvement by default and make it opt-in. Updates #2815 Change-Id: I9977801f8debec7d489d97761f74000a4a33f71b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Aaron Bieber	189f359609	net/dns: teach OpenBSD's manager to talk to resolvd(8). (#2789 ) OpenBSD 6.9 and up has a daemon which handles nameserver configuration. This PR teaches the OpenBSD dns manager to check if resolvd is being used. If it is, it will use the route(8) command to tell resolvd to add the Tailscale dns entries to resolv.conf Signed-off-by: Aaron Bieber <aaron@bolddaemon.com>	2 years ago
Brad Fitzpatrick	8d0ed1c9ba	net/dns/resolver: on Android, make ExitDNS use net package for DNS Like Windows. Updates #1738 Change-Id: I9f26bc58ce7e760c749786fbe5d9952c99eeb91c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	506c727e30	ipnlocal, net/{dns,tsaddr,tstun}, wgengine: support MagicDNS on IPv6 Fixes #3660 RELNOTE=MagicDNS now works over IPv6 when CGNAT IPv4 is disabled. Change-Id: I001e983df5feeb65289abe5012dedd177b841b45 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2513d2d728	net/{neterror,dns/resolver}: move PacketWasTruncated to neterror from DNS code And delete the unused code in net/dns/resolver/neterr_*.go. Change-Id: Ibe62c486bacce2733eb9968c96a98cbbdb2758bd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	eb26c081b1	net/dns: bound time we wait on restarting systemd-resolved in another place Fixes #3629 Updates #3537 Change-Id: I5d4b6acfcfdf0e3efcf6eb49c5e6cf4521e4baed Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0aa4c6f147	net/dns/resolver: add debug HTML handler to see what DNS traffic was forwarded Change-Id: I6b790e92dcc608515ac8b178f2271adc9fd98f78 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	0848b36dd2	net/dns/resolver: add metrics to PTR lookup misses Updates tailscale/corp#3326 Change-Id: I58077d889a3b58ef0633267c92ffb265686ce152 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	39f22a357d	net/dns/resolver: send NXDOMAIN to iOS DNS-SD/Bonjour queries Don't just ignore them. See if this makes them calm down. Updates #3363 Change-Id: Id1d66308e26660d26719b2538b577522a1e36b63 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	394c9de02b	net/dns/resolver: add nameFromQuery benchmark To convince me it's not as alloc-y as it looks. Change-Id: I503a0cc267268a23d2973dfde9833c420be4e868 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c7052154d5	net/dns/resolver: fix the subject in a func comment Change-Id: I519268c20dbd2c2da92da565839d3c1c84612dcc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	486059589b	all: gofmt -w -s (simplify) tests And it updates the build tag style on a couple files. Change-Id: I84478d822c8de3f84b56fa1176c99d2ea5083237 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cced414c7d	net/dns/resolver: add Windows ExitDNS service support, using net package Updates #1713 Updates #835 Change-Id: Ia71e96d0632c2d617b401695ad68301b07c1c2ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cab5c46481	net/dns: bound how long we block looking for, restarting systemd-resolved Fixes #3537 Change-Id: Iba6a3cde75983490d4072b5341f48dbfa2f997c0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Aaron Klotz	f93cf6fa03	net/dns: fix checking for wrapped error when attempting to read wsl.conf for Windows WSL2 Fixes https://github.com/tailscale/tailscale/issues/3437 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	3 years ago
David Anderson	124363e0ca	net/dns: detect and decode UTF-16 from wsl.exe earlier. Fixes #3170 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	78b0bd2957	net/dns/resolver: add clientmetrics for DNS Fixes tailscale/corp#1811 Change-Id: I864d11e0332a177e8c5ff403591bff6fec548f5a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	d10cefdb9b	net/dns: require space after nameserver/search parsing resolv.conf Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Josh Bleecher Snyder	9f00510833	net/dns: handle comments in resolv.conf Currently, comments in resolv.conf cause our parser to fail, with error messages like: ParseIP("192.168.0.100 # comment"): unexpected character (at " # comment") Fix that. Noticed while looking through logs. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	283ae702c1	ipn/ipnlocal: start adding DoH DNS server to peerapi when exit node Updates #1713 Change-Id: I8d9c488f779e7acc811a9bc18166a2726198a429 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	88b8a09d37	net/dns: make constants for the various DBus strings. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6c82cebe57	health: add a health state for net/dns.OSConfigurator. Lets the systemd-resolved OSConfigurator report health changes for out of band config resyncs. Updates #3327 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4ef3fed100	net/dns: resync config to systemd-resolved when it restarts. Fixes #3327 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cf9169e4be	net/dns: remove unused Config struct element. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Brad Fitzpatrick	400ed799e6	net/dns: work around old systemd-resolved setLinkDomain length limit Don't set all the *.arpa. reverse DNS lookup domains if systemd-resolved is old and can't handle them. Fixes #3188 Change-Id: I283f8ce174daa8f0a972ac7bfafb6ff393dde41d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	c5d572f371	net/dns: correctly handle NetworkManager-managed DNS that points to resolved. Fixes #3304 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	94fb42d4b2	all: use testingutil.MinAllocsPerRun There are a few remaining uses of testing.AllocsPerRun: Two in which we only log the number of allocations, and one in which dynamically calculate the allocations target based on a different AllocsPerRun run. This also allows us to tighten the "no allocs" test in wgengine/filter. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Denton Gentry	139a6c4c9c	net/dns: detect when resolvconf points to systemd-resolved. There are /etc/resolv.conf files out there where resolvconf wrote the file but pointed to systemd-resolved as the nameserver. We're better off handling those as systemd-resolved. > # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) > # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN > # 127.0.0.53 is the systemd-resolved stub resolver. > # run "systemd-resolve --status" to see details about the actual nameservers. Fixes https://github.com/tailscale/tailscale/issues/3026 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
David Anderson	a320d70614	net/dns: fall back to copy+delete/truncate if moving to/from /etc/resolv.conf fails. In some containers, /etc/resolv.conf is a bind-mount from outside the container. This prevents renaming to or from /etc/resolv.conf, because it's on a different filesystem from linux's perspective. It also prevents removing /etc/resolv.conf, because doing so would break the bind-mount. If we find ourselves within this environment, fall back to using copy+delete when renaming to /etc/resolv.conf, and copy+truncate when renaming from /etc/resolv.conf. Fixes #3000 Co-authored-by: Denton Gentry <dgentry@tailscale.com> Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	04d24d3a38	net/dns: move directManager function below directManager's definition. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	422ea4980f	net/dns: remove a tiny wrapper function that isn't contributing anything. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Maxim Merzhanov	9f954628e5	net/dns: ignore UnknownMethod error in SetLinkDefaultRoute for resolved manager Signed-off-by: Maxim Merzhanov <maksimmerzh@gmail.com>	3 years ago
Maisem Ali	7817ab6b20	net/dns/resolver: set maxDoHInFlight to 1000 on iOS 15+. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Crawshaw	77696579f5	net/dns/resolver: drop dropping log Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	676fb458c3	net/dns/resolver: make hasRDNSBonjourPrefix match shorter queries too Fixes tailscale/corp#2886 Updates tailscale/corp#2820 Updates #2442 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
nicksherron	f01ff18b6f	all: fix spelling mistakes Signed-off-by: nicksherron <nsherron90@gmail.com>	3 years ago
Smitty	b382161fe5	tsdns: don't forward transient DNS errors When a DNS server claims to be unable or unwilling to handle a request, instead of passing that refusal along to the client, just treat it as any other error trying to connect to the DNS server. This prevents DNS requests from failing based on if a server can respond with a transient error before another server is able to give an actual response. DNS requests only failing sometimes is really hard to find the cause of (#1033). Signed-off-by: Smitty <me@smitop.com>	3 years ago
Denton Gentry	d883747d8b	net/dns/resolver: don't forward DNS-SD on all platforms We added the initial handling only for macOS and iOS. With 1.16.0 now released, suppress forwarding DNS-SD on all platforms to test it through the 1.17.x cycle. Updates #2442 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	297d1b7cb6	net/dns/resolver: don't forward DNS-SD queries Updates #2442 Fixes tailscale/corp#2820 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	47044f3af7	net/dns/resolver: fix log prefix The passed in logf already has a "dns: " prefix so they were doubled up.	3 years ago
Brad Fitzpatrick	7634af5c6f	all: gofmt Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Filippo Valsorda	d7ce2be5f4	net/dns/resolver: add unsecured Quad9 resolvers DNSSEC is an availability issue, as recently demonstrated by the Slack issue, with limited security advantage. DoH on the other hand is a critical security upgrade. This change adds DoH support for the non-DNSSEC endpoints of Quad9. https://www.quad9.net/service/service-addresses-and-features#unsec Signed-off-by: Filippo Valsorda <hi@filippo.io>	3 years ago
Denton Gentry	93c2882a2f	wgengine: flush DNS cache after major link change. Windows has a public dns.Flush used in router_windows.go. However that won't work for platforms like Linux, where we need a different flush mechanism for resolved versus other implementations. We're instead adding a FlushCaches method to the dns Manager, which can be made to work on all platforms as needed. Fixes https://github.com/tailscale/tailscale/issues/2132 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Maxim Merzhanov	d43fcd2f02	net/dns: fix error wrapping for SetLinkDefaultRoute in resolved Signed-off-by: Maxim Merzhanov <maksimmerzh@gmail.com>	3 years ago
Brad Fitzpatrick	640134421e	all: update tests to use tstest.MemLogger And give MemLogger a mutex, as one caller had, which does match the logf contract better. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Anderson	bb6fdfb243	net/dns: fix the build on freebsd (missing default case in switch) Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	b3b1c06b3a	net/dns: only restart systemd-resolved if we changed /etc/resolv.conf. Reported on IRC: in an edge case, you can end up with a directManager DNS manager and --accept-dns=false, in which case we should do nothing, but actually end up restarting resolved whenever the netmap changes, even though the user told us to not manage DNS. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	10547d989d	net/dns: exhaustively test DNS selection paths for linux. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c071bcda33	net/dns: relax systemd-resolved detection. Reported on IRC: a resolv.conf that contained two entries for "nameserver 127.0.0.53", which defeated our "is resolved actually in charge" check. Relax that check to allow any number of nameservers, as long as they're all 127.0.0.53. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	39748e9562	net/dns/resolver: authoritatively return NXDOMAIN for reverse zones we own. Fixes #2774 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Emmanuel T Odeke	0daa32943e	all: add (*testing.B).ReportAllocs() to every benchmark This ensures that we can properly track and catch allocation slippages that could otherwise have been missed. Fixes #2748	3 years ago
Brad Fitzpatrick	065c4ffc2c	net/dns: add start of Linux newOSConfigurator tests Only one test case so far. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	09a47ea3f1	net/dns: prep for writing manager_linux tests; pull some stuff out Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
slowy07	ac0353e982	fix: typo spelling grammar Signed-off-by: slowy07 <slowy.arfy@gmail.com>	3 years ago
David Crawshaw	0ac2130590	net/dns: resolveConfExists reading the wrong error Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	36ffd509de	net/dns: avoid Linux PolicyKit GUI dialog during tests Fixes #2672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	a24cee0d67	all: simplify ts_macext build tags Now that we have the easier-to-parse go:build build tags, it is straightforward to simplify them. Yay. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Adrian Dewhurst	8bdf878832	net/dns/resolver: use forwarded dns txid directly Previously, we hashed the question and combined it with the original txid which was useful when concurrent queries were multiplexed on a single local source port. We encountered some situations where the DNS server canonicalizes the question in the response (uppercase converted to lowercase in this case), which resulted in responses that we couldn't match to the original request due to hash mismatches. This includes a new test to cover that situation. Fixes #2597 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Denton Gentry	260b85458c	net/dns: correct log message. Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	54e33b511a	net/dns/resolver: add test that I forgot to git add earlier This was meant to be part of `53a2f63658` earlier but I guess I failed at git. Updates #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	be921d1a95	net/dns/resolver: fix skipped DoH test that bitrot Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	881bb8bcdc	net/dns/resolver: allow an extra alloc for go closure allocation Go 1.17 switches to a register ABI on amd64 platforms. Part of that switch is that go and defer calls use an argument-less closure, which allocates. This means that we have an extra alloc in some DNS work. That's unfortunate but not a showstopper, and I don't see a clear path to fixing it. The other performance benefits from the register ABI will all but certainly outweigh this extra alloc. Fixes #2545 Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Crawshaw	f414a9cc01	net/dns/resolver: EDNS OPT record off-by-one I don't know how to get access to a real packet. Basing this commit entirely off: +------------+--------------+------------------------------+ \| Field Name \| Field Type \| Description \| +------------+--------------+------------------------------+ \| NAME \| domain name \| MUST be 0 (root domain) \| \| TYPE \| u_int16_t \| OPT (41) \| \| CLASS \| u_int16_t \| requestor's UDP payload size \| \| TTL \| u_int32_t \| extended RCODE and flags \| \| RDLEN \| u_int16_t \| length of all RDATA \| \| RDATA \| octet stream \| {attribute,value} pairs \| +------------+--------------+------------------------------+ From https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	53a2f63658	net/dns/resolver: race well-known resolvers less aggressively Instead of blasting away at all upstream resolvers at the same time, make a timing plan upon reconfiguration and have each upstream have an associated start delay, depending on the overall forwarding config. So now if you have two or four upstream Google or Cloudflare DNS servers (e.g. two IPv4 and two IPv6), we now usually only send a query, not four. This is especially nice on iOS where we start fewer DoH queries and thus fewer HTTP/1 requests (because we still disable HTTP/2 on iOS), fewer sockets, fewer goroutines, and fewer associated HTTP buffers, etc, saving overall memory burstiness. Fixes #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e94ec448a7	net/dns/resolver: add forwardQuery type as race work prep Add a place to hang state in a future change for #2436. For now this just simplifies the send signature without any functional change. Updates #2436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	064b916b1a	net/dns/resolver: fix func used as netaddr.IP in printf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	cecfc14875	net/dns: don't build init*.go on non-windows To remove the regexp dep on iOS, notably. Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2968893add	net/dns/resolver: bound DoH usage on iOS Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3daf27eaad	net/dns/resolver: fall back to IPv6 for well-known DoH servers if v4 fails Should help with IPv6-only environments when the tailnet admin only specified IPv4 DNS IPs. See https://github.com/tailscale/tailscale/issues/2447#issuecomment-884188562 Co-Author: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	74eee4de1c	net/dns/resolver: use correct Cloudflare DoH hostnames We were using the wrong ones for the malware & adult content variants. Docs: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https Earlier commit which added them: `236eb4d04d` Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e74d37d30f	net/dns{,/resolver}: quiet DNS output logging It was a huge chunk of the overall log output and made debugging difficult. Omit and summarize the spammy *.arpa parts instead. Fixes tailscale/corp#2066 (to which nobody had opinions, so)	3 years ago
Brad Fitzpatrick	236eb4d04d	net/dns/resolver: upgrade forwarded MagicDNS queries to DoH when IP known Recognize Cloudflare, Google, Quad9 which are by far the majority of upstream DNS servers that people use. RELNOTE=MagicDNS now uses DNS-over-HTTPS when querying popular upstream resolvers, so DNS queries aren't sent in the clear over the Internet. Updates #915 (might fix it?) Updates #988 (gets us closer, if it fixes Android) Updates #74 (not yet configurable, but progress) Updates #2056 (not yet configurable, dup of #74?) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	6b9f8208f4	net/dns: do not run wsl.exe as LocalSystem It doesn't work. It needs to run as the user. https://github.com/microsoft/WSL/issues/4803 The mechanism for doing this was extracted from: https://web.archive.org/web/20101009012531/http://blogs.msdn.com/b/winsdk/archive/2009/07/14/launching-an-interactive-process-from-windows-service-in-windows-vista-and-later.aspx While here, we also reclaculate WSL distro set on SetDNS. This accounts for: 1. potential inability to access wsl.exe on startup 2. WSL being installed while Tailscale is running 3. A new WSL distrobution being installed Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	1147c7fd4f	net/dns: set WSL /etc/resolv.conf We also have to make a one-off change to /etc/wsl.conf to stop every invocation of wsl.exe clobbering the /etc/resolv.conf. This appears to be a safe change to make permanently, as even though the resolv.conf is constantly clobbered, it is always the same stable internal IP that is set as a nameserver. (I believe the resolv.conf clobbering predates the MS stub resolver.) Tested on WSL2, should work for WSL1 too. Fixes #775 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Crawshaw	9b063b86c3	net/dns: factor directManager out over an FS interface This is preliminary work for using the directManager as part of a wslManager on windows, where in addition to configuring windows we'll use wsl.exe to edit the linux file system and modify the system resolv.conf. The pinholeFS is a little funky, but it's designed to work through simple unix tools via wsl.exe without invoking bash. I would not have thought it would stand on its own like this, but it turns out it's useful for writing a test for the directManager. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
julianknodt	72a0b5f042	net/dns/resolver: fmt item This has been bothering me for a while, but everytime I run format from the root directory it also formats this file. I didn't want to add it to my other PRs but it's annoying to have to revert it every time. Signed-off-by: julianknodt <julianknodt@gmail.com>	3 years ago
David Crawshaw	80b1308974	net/dns: remove ref to managerImpl Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Adrian Dewhurst	bcaae3e074	net/dns/resolver: clamp EDNS size This change (subject to some limitations) looks for the EDNS OPT record in queries and responses, clamping the size field to fit within our DNS receive buffer. If the size field is smaller than the DNS receive buffer then it is left unchanged. I think we will eventually need to transition to fully processing the DNS queries to handle all situations, but this should cover the most common case. Mostly fixes #2066 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	084d48d22d	net/dns: always proxy through quad-100 on windows 8.1. Windows 8.1 incorrectly handles search paths on an interface with no associated resolver, so we have to provide a full primary DNS config rather than use Windows 8.1's nascent-but-present NRPT functionality. Fixes #2237. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	733d52827b	net/dns/resolver: skip test on macOS Fixes #2229 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Crawshaw	297b3d6fa4	staticcheck.conf: turn off noisy lint errors Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
David Anderson	9337826011	net/dns: fix inverted test for NetworkManager version. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	320cc8fa21	net/dns: verify that systemd-resolved is actually in charge. It's possible to install a configuration that passes our current checks for systemd-resolved, without actually pointing to systemd-resolved. In that case, we end up programming DNS in resolved, but that config never applies to any name resolution requests on the system. This is quite a far-out edge case, but there's a simple additional check we can do: if the header comment names systemd-resolved, there should be a single nameserver in resolv.conf pointing to 127.0.0.53. If not, the configuration should be treated as an unmanaged resolv.conf. Fixes #2136. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e7164425b3	net/dns: don't use NetworkManager for DNS on very old NetworkManagers. Fixes #1945. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Dave Anderson	144c68b80b	net/dns: avoid using NetworkManager as much as possible. (#1945 ) Addresses #1699 as best as possible. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Adrian Dewhurst	8b11937eaf	net/dns/resolver: permit larger max responses, signal truncation This raises the maximum DNS response message size from 512 to 4095. This should be large enough for almost all situations that do not need TCP. We still do not recognize EDNS, so we will still forward requests that claim support for a larger response size than 4095 (that will be solved later). For now, when a response comes back that is too large to fit in our receive buffer, we now set the truncation flag in the DNS header, which is an improvement from before but will prompt attempts to use TCP which isn't supported yet. On Windows, WSARecvFrom into a buffer that's too small returns an error in addition to the data. On other OSes, the extra data is silently discarded. In this case, we prefer the latter so need to catch the error on Windows. Partially addresses #1123 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	7fab244614	net/dns/resolver: don't spam logs on EHOSTUNREACH. Fixes #1719. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
David Anderson	cfde997699	net/dns: don't use interfaces.Tailscale to find the tailscale interface index. interfaces.Tailscale only returns an interface if it has at least one Tailscale IP assigned to it. In the resolved DNS manager, when we're called upon to tear down DNS config, the interface no longer has IPs. Instead, look up the interface index on construction and reuse it throughout the daemon lifecycle. Fixes #1892. Signed-off-by: David Anderson <dave@natulte.net>	3 years ago
David Anderson	3c8e230ee1	Revert "net/dns: set IPv4 auto mode in NM, so it lets us set DNS." This reverts commit `7d16c8228b`. I have no idea how I ended up here. The bug I was fixing with this change fails to reproduce on Ubuntu 18.04 now, and this change definitely does break 20.04, 20.10, and Debian Buster. So, until we can reliably reproduce the problem this was meant to fix, reverting. Part of #1875 Signed-off-by: David Anderson <dave@natulte.net>	3 years ago
David Anderson	5bd38b10b4	net/dns: log the correct error when NM Reapply fails. Found while debugging #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	7d16c8228b	net/dns: set IPv4 auto mode in NM, so it lets us set DNS. Part of #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	77e2375501	net/dns: don't try to configure LLMNR or mdns in NetworkManager. Fixes #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	20e04418ff	net/dns: add GOOS build tags Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	3 years ago
David Anderson	bf9ef1ca27	net/dns: stop NetworkManager breaking v6 connectivity when setting DNS. Tentative fix for #1699 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	44c2b7dc79	net/dns: on windows, skip site-local v6 resolvers. Further refinement for tailscale/corp#1662. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	97d2fa2f56	net/dns: work around WSL DNS implementation flaws. Fixes tailscale/corp#1662 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	f6b7d08aea	net/dns: work around new NetworkManager in other selection paths. Further bits of #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	25ce9885a2	net/dns: don't use NM+resolved for NM >=1.26.6. NetworkManager fixed the bug that forced us to use NetworkManager if it's programming systemd-resolved, and in the same release also made NetworkManager ignore DNS settings provided for unmanaged interfaces... Which breaks what we used to do. So, with versions 1.26.6 and above, we MUST NOT use NetworkManager to indirectly program systemd-resolved, but thankfully we can talk to resolved directly and get the right outcome. Fixes #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	30f5d706a1	net/dns/resolver: remove unnecessary/racy WaitGroup. Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	89c81c26c5	net/dns: fix resolved match domains when no nameservers are provided. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4be26b269f	net/dns: correctly capture all traffic in non-split configs. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	ca283ac899	net/dns: remove config in openresolv when given an empty DNS config. Part of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	53213114ec	net/dns: make debian_resolvconf correctly clear DNS configs. More of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	3b1ab78954	net/dns: restore resolv.conf when given an empty config in directManager. Fixes #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	158328ba24	net/dns: remove ForceSplitDNSForTesting. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	bb0710d51d	net/dns: add debugging traces to DNS manager selection on linux. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4b70c7b717	net/dns: fix inverted test for NetworkManager. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	4849a4d3c8	net/dns: error out on linux if /etc/resolv.conf can't be read. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	1f9b73a531	net/dns: fix freebsd DNS manager selection. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	c2ca2ac8c4	net/dns: fix FreeBSD build Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	84bd50329a	net/dns: fix staticheck. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d6bb11b5bf	net/dns: implement correct manager detection on linux. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9ef932517b	net/dns: fix NM's GetBaseConfig when no configs exist. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	fe3b1ab747	net/dns: refactor dbus connection setup in resolved manager. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	854d5d36a1	net/dns: return error from NewOSManager, use it to initialize NM. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9aa33b43e6	net/dns: support split and unsplit DNS in NetworkManager. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	87eb8384f5	net/dns: fix up NetworkManager configurator a bit. Clear LLMNR and mdns flags, update reasoning for our settings, and set our override priority harder than before when we want to be primary resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	3d81e6260b	net/dns: set resolved DefaultRoute setting according to split-dns mode. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	cca230cc23	net/dns: fix staticcheck errors. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	4b47393e0c	net/dns: pacify staticcheck for now Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
David Anderson	a7340c2015	net/dns: support split DNS in systemd-resolved. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	84430cdfa1	net/dns: improve NetworkManager detection, using more DBus. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9a48bac8ad	net/dns: rename resolvconf.go to debian_resolvconf.go. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9831f1b183	net/dns: also include 'tail' and 'base' files when fixing up resolv.conf. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e43afe9140	net/dns: implement prior config reading for debian resolvconf. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	143e5dd087	net/dns: rename script variable. Debian resolvconf is not legacy, it's alive and well, just historically before the other implementations. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	55b39fa945	net/dns: add documentation to openresolv's config fetch. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	61b361bac0	net/dns: teach the openresolv manager to read DNS config. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	58760f7b82	net/dns: split resolvconfManager into a debian and an openresolv manager. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	5480189313	net/dns: implement a DNS override workaround for legacy resolvconf. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e638a4d86b	net/dns: make directManager support split DNS, and work in sandboxes. Fixes #1495, #683. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	2685260ba1	net/dns: add temporary fallback to quad-9 resolver for split-DNS testing. This allows split-DNS configurations to not break clients on OSes that haven't yet been ported to understand split DNS, by falling back to quad-9 as a global resolver when handed an "impossible to implement" split-DNS config. Part of #953. Needs to be removed before shipping 1.8. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	b9e194c14b	net/dns: add missing FQDN qualification. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	b74a8994ca	net/dns: make FQDN dot style consistent in more places. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6def647514	net/dns/resolver: don't avoid tailscale routes for DNS forwarding. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago

1 2 3 4 5 ...

293 Commits (51b0169b101d19840340fd43883a024873c28358)