71 Commits (7330aa593e3701cb193ceff0bc26eda3bc62df83)

Author	SHA1	Message	Date
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH ... We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Adrian Dewhurst	8bdf878832	net/dns/resolver: use forwarded dns txid directly ... Previously, we hashed the question and combined it with the original txid which was useful when concurrent queries were multiplexed on a single local source port. We encountered some situations where the DNS server canonicalizes the question in the response (uppercase converted to lowercase in this case), which resulted in responses that we couldn't match to the original request due to hash mismatches. This includes a new test to cover that situation. Fixes #2597 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Crawshaw	f414a9cc01	net/dns/resolver: EDNS OPT record off-by-one ... I don't know how to get access to a real packet. Basing this commit entirely off: +------------+--------------+------------------------------+ | Field Name | Field Type | Description | +------------+--------------+------------------------------+ | NAME | domain name | MUST be 0 (root domain) | | TYPE | u_int16_t | OPT (41) | | CLASS | u_int16_t | requestor's UDP payload size | | TTL | u_int32_t | extended RCODE and flags | | RDLEN | u_int16_t | length of all RDATA | | RDATA | octet stream | {attribute,value} pairs | +------------+--------------+------------------------------+ From https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	53a2f63658	net/dns/resolver: race well-known resolvers less aggressively ... Instead of blasting away at all upstream resolvers at the same time, make a timing plan upon reconfiguration and have each upstream have an associated start delay, depending on the overall forwarding config. So now if you have two or four upstream Google or Cloudflare DNS servers (e.g. two IPv4 and two IPv6), we now usually only send a query, not four. This is especially nice on iOS where we start fewer DoH queries and thus fewer HTTP/1 requests (because we still disable HTTP/2 on iOS), fewer sockets, fewer goroutines, and fewer associated HTTP buffers, etc, saving overall memory burstiness. Fixes #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e94ec448a7	net/dns/resolver: add forwardQuery type as race work prep ... Add a place to hang state in a future change for #2436. For now this just simplifies the send signature without any functional change. Updates #2436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	064b916b1a	net/dns/resolver: fix func used as netaddr.IP in printf ... Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2968893add	net/dns/resolver: bound DoH usage on iOS ... Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3daf27eaad	net/dns/resolver: fall back to IPv6 for well-known DoH servers if v4 fails ... Should help with IPv6-only environments when the tailnet admin only specified IPv4 DNS IPs. See https://github.com/tailscale/tailscale/issues/2447#issuecomment-884188562 Co-Author: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	74eee4de1c	net/dns/resolver: use correct Cloudflare DoH hostnames ... We were using the wrong ones for the malware & adult content variants. Docs: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https Earlier commit which added them: 236eb4d04d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	236eb4d04d	net/dns/resolver: upgrade forwarded MagicDNS queries to DoH when IP known ... Recognize Cloudflare, Google, Quad9 which are by far the majority of upstream DNS servers that people use. RELNOTE=MagicDNS now uses DNS-over-HTTPS when querying popular upstream resolvers, so DNS queries aren't sent in the clear over the Internet. Updates #915 (might fix it?) Updates #988 (gets us closer, if it fixes Android) Updates #74 (not yet configurable, but progress) Updates #2056 (not yet configurable, dup of #74?) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	bcaae3e074	net/dns/resolver: clamp EDNS size ... This change (subject to some limitations) looks for the EDNS OPT record in queries and responses, clamping the size field to fit within our DNS receive buffer. If the size field is smaller than the DNS receive buffer then it is left unchanged. I think we will eventually need to transition to fully processing the DNS queries to handle all situations, but this should cover the most common case. Mostly fixes #2066 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS ... Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	8b11937eaf	net/dns/resolver: permit larger max responses, signal truncation ... This raises the maximum DNS response message size from 512 to 4095. This should be large enough for almost all situations that do not need TCP. We still do not recognize EDNS, so we will still forward requests that claim support for a larger response size than 4095 (that will be solved later). For now, when a response comes back that is too large to fit in our receive buffer, we now set the truncation flag in the DNS header, which is an improvement from before but will prompt attempts to use TCP which isn't supported yet. On Windows, WSARecvFrom into a buffer that's too small returns an error in addition to the data. On other OSes, the extra data is silently discarded. In this case, we prefer the latter so need to catch the error on Windows. Partially addresses #1123 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	7fab244614	net/dns/resolver: don't spam logs on EHOSTUNREACH. ... Fixes #1719. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	30f5d706a1	net/dns/resolver: remove unnecessary/racy WaitGroup. ... Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	6def647514	net/dns/resolver: don't avoid tailscale routes for DNS forwarding. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	c4530971db	net/dns/resolver: remove leftover debug print. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	9f105d3968	net/dns/resolver: teach the forwarder to do per-domain routing. ... Given a DNS route map, the forwarder selects the right set of upstreams for a given name. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	f185d62dc8	net/dns/resolver: unexport Packet, only use it internally. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. ... Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago