tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	c37af58ea4	net/tsdial: move more weirdo dialing into new tsdial package, plumb Not done yet, but this move more of the outbound dial special casing from random packages into tsdial, which aspires to be the one unified place for all outbound dialing shenanigans. Then this plumbs it all around, so everybody is ultimately holding on to the same dialer. As of this commit, macOS/iOS using an exit node should be able to reach to the exit node's DoH DNS proxy over peerapi, doing the sockopt to stay within the Network Extension. A number of steps remain, including but limited to: * move a bunch more random dialing stuff * make netstack-mode tailscaled be able to use exit node's DNS proxy, teaching tsdial's resolver to use it when an exit node is in use. Updates #1713 Change-Id: I1e8ee378f125421c2b816f47bc2c6d913ddcd2f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3ae6f898cf	ipn/ipnlocal, net/dns/resolver: use exit node's DoH proxy when available Updates #1713 Change-Id: I3695a40ec12d2b4e6dac41cf4559daca6dddd68e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	135580a5a8	tailcfg, ipn/ipnlocal, net/dns: forward exit node DNS on Unix to system DNS Updates #1713 Change-Id: I4c073fec0992d9e01a9a4ce97087d5af0efdc68d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	78b0bd2957	net/dns/resolver: add clientmetrics for DNS Fixes tailscale/corp#1811 Change-Id: I864d11e0332a177e8c5ff403591bff6fec548f5a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	25525b7754	net/dns/resolver, ipn/ipnlocal: wire up peerapi DoH server to DNS forwarder Updates #1713 Change-Id: Ia4ed9d8c9cef0e70aa6d30f2852eaab80f5f695a Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Josh Bleecher Snyder	758c37b83d	net/netns: thread logf into control functions So that darwin can log there without panicking during tests. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Maisem Ali	7817ab6b20	net/dns/resolver: set maxDoHInFlight to 1000 on iOS 15+. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
David Crawshaw	77696579f5	net/dns/resolver: drop dropping log Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Smitty	b382161fe5	tsdns: don't forward transient DNS errors When a DNS server claims to be unable or unwilling to handle a request, instead of passing that refusal along to the client, just treat it as any other error trying to connect to the DNS server. This prevents DNS requests from failing based on if a server can respond with a transient error before another server is able to give an actual response. DNS requests only failing sometimes is really hard to find the cause of (#1033). Signed-off-by: Smitty <me@smitop.com>	3 years ago
Denton Gentry	d883747d8b	net/dns/resolver: don't forward DNS-SD on all platforms We added the initial handling only for macOS and iOS. With 1.16.0 now released, suppress forwarding DNS-SD on all platforms to test it through the 1.17.x cycle. Updates #2442 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	3 years ago
Brad Fitzpatrick	297d1b7cb6	net/dns/resolver: don't forward DNS-SD queries Updates #2442 Fixes tailscale/corp#2820 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	7634af5c6f	all: gofmt Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Filippo Valsorda	d7ce2be5f4	net/dns/resolver: add unsecured Quad9 resolvers DNSSEC is an availability issue, as recently demonstrated by the Slack issue, with limited security advantage. DoH on the other hand is a critical security upgrade. This change adds DoH support for the non-DNSSEC endpoints of Quad9. https://www.quad9.net/service/service-addresses-and-features#unsec Signed-off-by: Filippo Valsorda <hi@filippo.io>	3 years ago
David Crawshaw	9502b515f1	net/dns: replace resolver IPs with type for DoH We currently plumb full URLs for DNS resolvers from the control server down to the client. But when we pass the values into the net/dns package, we throw away any URL that isn't a bare IP. This commit continues the plumbing, and gets the URL all the way to the built in forwarder. (It stops before plumbing URLs into the OS configurations that can handle them.) For #2596 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Adrian Dewhurst	8bdf878832	net/dns/resolver: use forwarded dns txid directly Previously, we hashed the question and combined it with the original txid which was useful when concurrent queries were multiplexed on a single local source port. We encountered some situations where the DNS server canonicalizes the question in the response (uppercase converted to lowercase in this case), which resulted in responses that we couldn't match to the original request due to hash mismatches. This includes a new test to cover that situation. Fixes #2597 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Crawshaw	f414a9cc01	net/dns/resolver: EDNS OPT record off-by-one I don't know how to get access to a real packet. Basing this commit entirely off: +------------+--------------+------------------------------+ \| Field Name \| Field Type \| Description \| +------------+--------------+------------------------------+ \| NAME \| domain name \| MUST be 0 (root domain) \| \| TYPE \| u_int16_t \| OPT (41) \| \| CLASS \| u_int16_t \| requestor's UDP payload size \| \| TTL \| u_int32_t \| extended RCODE and flags \| \| RDLEN \| u_int16_t \| length of all RDATA \| \| RDATA \| octet stream \| {attribute,value} pairs \| +------------+--------------+------------------------------+ From https://datatracker.ietf.org/doc/html/rfc6891#section-6.1.2 Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	3 years ago
Brad Fitzpatrick	53a2f63658	net/dns/resolver: race well-known resolvers less aggressively Instead of blasting away at all upstream resolvers at the same time, make a timing plan upon reconfiguration and have each upstream have an associated start delay, depending on the overall forwarding config. So now if you have two or four upstream Google or Cloudflare DNS servers (e.g. two IPv4 and two IPv6), we now usually only send a query, not four. This is especially nice on iOS where we start fewer DoH queries and thus fewer HTTP/1 requests (because we still disable HTTP/2 on iOS), fewer sockets, fewer goroutines, and fewer associated HTTP buffers, etc, saving overall memory burstiness. Fixes #2436 Updates tailscale/corp#2250 Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	e94ec448a7	net/dns/resolver: add forwardQuery type as race work prep Add a place to hang state in a future change for #2436. For now this just simplifies the send signature without any functional change. Updates #2436 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	064b916b1a	net/dns/resolver: fix func used as netaddr.IP in printf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	2968893add	net/dns/resolver: bound DoH usage on iOS Updates tailscale/corp#2238 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	3daf27eaad	net/dns/resolver: fall back to IPv6 for well-known DoH servers if v4 fails Should help with IPv6-only environments when the tailnet admin only specified IPv4 DNS IPs. See https://github.com/tailscale/tailscale/issues/2447#issuecomment-884188562 Co-Author: Adrian Dewhurst <adrian@tailscale.com> Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	74eee4de1c	net/dns/resolver: use correct Cloudflare DoH hostnames We were using the wrong ones for the malware & adult content variants. Docs: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https Earlier commit which added them: `236eb4d04d` Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	236eb4d04d	net/dns/resolver: upgrade forwarded MagicDNS queries to DoH when IP known Recognize Cloudflare, Google, Quad9 which are by far the majority of upstream DNS servers that people use. RELNOTE=MagicDNS now uses DNS-over-HTTPS when querying popular upstream resolvers, so DNS queries aren't sent in the clear over the Internet. Updates #915 (might fix it?) Updates #988 (gets us closer, if it fixes Android) Updates #74 (not yet configurable, but progress) Updates #2056 (not yet configurable, dup of #74?) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	bcaae3e074	net/dns/resolver: clamp EDNS size This change (subject to some limitations) looks for the EDNS OPT record in queries and responses, clamping the size field to fit within our DNS receive buffer. If the size field is smaller than the DNS receive buffer then it is left unchanged. I think we will eventually need to transition to fully processing the DNS queries to handle all situations, but this should cover the most common case. Mostly fixes #2066 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Brad Fitzpatrick	45e64f2e1a	net/dns{,/resolver}: refactor DNS forwarder, send out of right link on macOS/iOS Fixes #2224 Fixes tailscale/corp#2045 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Adrian Dewhurst	8b11937eaf	net/dns/resolver: permit larger max responses, signal truncation This raises the maximum DNS response message size from 512 to 4095. This should be large enough for almost all situations that do not need TCP. We still do not recognize EDNS, so we will still forward requests that claim support for a larger response size than 4095 (that will be solved later). For now, when a response comes back that is too large to fit in our receive buffer, we now set the truncation flag in the DNS header, which is an improvement from before but will prompt attempts to use TCP which isn't supported yet. On Windows, WSARecvFrom into a buffer that's too small returns an error in addition to the data. On other OSes, the extra data is silently discarded. In this case, we prefer the latter so need to catch the error on Windows. Partially addresses #1123 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	7fab244614	net/dns/resolver: don't spam logs on EHOSTUNREACH. Fixes #1719. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	30f5d706a1	net/dns/resolver: remove unnecessary/racy WaitGroup. Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6def647514	net/dns/resolver: don't avoid tailscale routes for DNS forwarding. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c4530971db	net/dns/resolver: remove leftover debug print. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9f105d3968	net/dns/resolver: teach the forwarder to do per-domain routing. Given a DNS route map, the forwarder selects the right set of upstreams for a given name. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f185d62dc8	net/dns/resolver: unexport Packet, only use it internally. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago

1 2

84 Commits (7b1c764088673cfe17e2a8695170cdec8cfc47fd)