tailscale

Commit Graph

Author	SHA1	Message	Date
David Anderson	320cc8fa21	net/dns: verify that systemd-resolved is actually in charge. It's possible to install a configuration that passes our current checks for systemd-resolved, without actually pointing to systemd-resolved. In that case, we end up programming DNS in resolved, but that config never applies to any name resolution requests on the system. This is quite a far-out edge case, but there's a simple additional check we can do: if the header comment names systemd-resolved, there should be a single nameserver in resolv.conf pointing to 127.0.0.53. If not, the configuration should be treated as an unmanaged resolv.conf. Fixes #2136. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e7164425b3	net/dns: don't use NetworkManager for DNS on very old NetworkManagers. Fixes #1945. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Dave Anderson	144c68b80b	net/dns: avoid using NetworkManager as much as possible. (#1945 ) Addresses #1699 as best as possible. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Adrian Dewhurst	8b11937eaf	net/dns/resolver: permit larger max responses, signal truncation This raises the maximum DNS response message size from 512 to 4095. This should be large enough for almost all situations that do not need TCP. We still do not recognize EDNS, so we will still forward requests that claim support for a larger response size than 4095 (that will be solved later). For now, when a response comes back that is too large to fit in our receive buffer, we now set the truncation flag in the DNS header, which is an improvement from before but will prompt attempts to use TCP which isn't supported yet. On Windows, WSARecvFrom into a buffer that's too small returns an error in addition to the data. On other OSes, the extra data is silently discarded. In this case, we prefer the latter so need to catch the error on Windows. Partially addresses #1123 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
David Anderson	7fab244614	net/dns/resolver: don't spam logs on EHOSTUNREACH. Fixes #1719. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	e2dcf63420	net/dns: replace AuthoritativeSuffixes with nil Route entries. This leads to a cleaner separation of intent vs. implementation (Routes is now the only place specifying who handles DNS requests), and allows for cleaner expression of a configuration that creates MagicDNS records without serving them to the OS. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6690f86ef4	net/dns: always offer MagicDNS records at 100.100.100.100. Fixes #1886. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	25df067dd0	all: adapt to opaque netaddr types This commit is a mishmash of automated edits using gofmt: gofmt -r 'netaddr.IPPort{IP: a, Port: b} -> netaddr.IPPortFrom(a, b)' -w . gofmt -r 'netaddr.IPPrefix{IP: a, Port: b} -> netaddr.IPPrefixFrom(a, b)' -w . gofmt -r 'a.IP.Is4 -> a.IP().Is4' -w . gofmt -r 'a.IP.As16 -> a.IP().As16' -w . gofmt -r 'a.IP.Is6 -> a.IP().Is6' -w . gofmt -r 'a.IP.As4 -> a.IP().As4' -w . gofmt -r 'a.IP.String -> a.IP().String' -w . And regexps: \w(.)\.Port = (.) -> $1 = $1.WithPort($2) \w(.)\.IP = (.) -> $1 = $1.WithIP($2) And lots of manual fixups. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	4 years ago
David Anderson	cfde997699	net/dns: don't use interfaces.Tailscale to find the tailscale interface index. interfaces.Tailscale only returns an interface if it has at least one Tailscale IP assigned to it. In the resolved DNS manager, when we're called upon to tear down DNS config, the interface no longer has IPs. Instead, look up the interface index on construction and reuse it throughout the daemon lifecycle. Fixes #1892. Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	3c8e230ee1	Revert "net/dns: set IPv4 auto mode in NM, so it lets us set DNS." This reverts commit `7d16c8228b`. I have no idea how I ended up here. The bug I was fixing with this change fails to reproduce on Ubuntu 18.04 now, and this change definitely does break 20.04, 20.10, and Debian Buster. So, until we can reliably reproduce the problem this was meant to fix, reverting. Part of #1875 Signed-off-by: David Anderson <dave@natulte.net>	4 years ago
David Anderson	5bd38b10b4	net/dns: log the correct error when NM Reapply fails. Found while debugging #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7d16c8228b	net/dns: set IPv4 auto mode in NM, so it lets us set DNS. Part of #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	77e2375501	net/dns: don't try to configure LLMNR or mdns in NetworkManager. Fixes #1870. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Josh Bleecher Snyder	20e04418ff	net/dns: add GOOS build tags Fixes #1786 Signed-off-by: Josh Bleecher Snyder <josharian@gmail.com>	4 years ago
David Anderson	bf9ef1ca27	net/dns: stop NetworkManager breaking v6 connectivity when setting DNS. Tentative fix for #1699 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	44c2b7dc79	net/dns: on windows, skip site-local v6 resolvers. Further refinement for tailscale/corp#1662. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	97d2fa2f56	net/dns: work around WSL DNS implementation flaws. Fixes tailscale/corp#1662 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f6b7d08aea	net/dns: work around new NetworkManager in other selection paths. Further bits of #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	25ce9885a2	net/dns: don't use NM+resolved for NM >=1.26.6. NetworkManager fixed the bug that forced us to use NetworkManager if it's programming systemd-resolved, and in the same release also made NetworkManager ignore DNS settings provided for unmanaged interfaces... Which breaks what we used to do. So, with versions 1.26.6 and above, we MUST NOT use NetworkManager to indirectly program systemd-resolved, but thankfully we can talk to resolved directly and get the right outcome. Fixes #1788 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	30f5d706a1	net/dns/resolver: remove unnecessary/racy WaitGroup. Fixes #1663 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	89c81c26c5	net/dns: fix resolved match domains when no nameservers are provided. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4be26b269f	net/dns: correctly capture all traffic in non-split configs. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	ca283ac899	net/dns: remove config in openresolv when given an empty DNS config. Part of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	53213114ec	net/dns: make debian_resolvconf correctly clear DNS configs. More of #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3b1ab78954	net/dns: restore resolv.conf when given an empty config in directManager. Fixes #1720. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	158328ba24	net/dns: remove ForceSplitDNSForTesting. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	bb0710d51d	net/dns: add debugging traces to DNS manager selection on linux. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4b70c7b717	net/dns: fix inverted test for NetworkManager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4849a4d3c8	net/dns: error out on linux if /etc/resolv.conf can't be read. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1f9b73a531	net/dns: fix freebsd DNS manager selection. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	c2ca2ac8c4	net/dns: fix FreeBSD build Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	84bd50329a	net/dns: fix staticheck. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d6bb11b5bf	net/dns: implement correct manager detection on linux. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9ef932517b	net/dns: fix NM's GetBaseConfig when no configs exist. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fe3b1ab747	net/dns: refactor dbus connection setup in resolved manager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	854d5d36a1	net/dns: return error from NewOSManager, use it to initialize NM. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9aa33b43e6	net/dns: support split and unsplit DNS in NetworkManager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	87eb8384f5	net/dns: fix up NetworkManager configurator a bit. Clear LLMNR and mdns flags, update reasoning for our settings, and set our override priority harder than before when we want to be primary resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3d81e6260b	net/dns: set resolved DefaultRoute setting according to split-dns mode. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cca230cc23	net/dns: fix staticcheck errors. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	4b47393e0c	net/dns: pacify staticcheck for now Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	a7340c2015	net/dns: support split DNS in systemd-resolved. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	84430cdfa1	net/dns: improve NetworkManager detection, using more DBus. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9a48bac8ad	net/dns: rename resolvconf.go to debian_resolvconf.go. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9831f1b183	net/dns: also include 'tail' and 'base' files when fixing up resolv.conf. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e43afe9140	net/dns: implement prior config reading for debian resolvconf. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	143e5dd087	net/dns: rename script variable. Debian resolvconf is not legacy, it's alive and well, just historically before the other implementations. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	55b39fa945	net/dns: add documentation to openresolv's config fetch. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	61b361bac0	net/dns: teach the openresolv manager to read DNS config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	58760f7b82	net/dns: split resolvconfManager into a debian and an openresolv manager. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5480189313	net/dns: implement a DNS override workaround for legacy resolvconf. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1a371b93be	util/dnsname: add FQDN type, use throughout codebase. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e638a4d86b	net/dns: make directManager support split DNS, and work in sandboxes. Fixes #1495, #683. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2685260ba1	net/dns: add temporary fallback to quad-9 resolver for split-DNS testing. This allows split-DNS configurations to not break clients on OSes that haven't yet been ported to understand split DNS, by falling back to quad-9 as a global resolver when handed an "impossible to implement" split-DNS config. Part of #953. Needs to be removed before shipping 1.8. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b9e194c14b	net/dns: add missing FQDN qualification. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b74a8994ca	net/dns: make FQDN dot style consistent in more places. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6def647514	net/dns/resolver: don't avoid tailscale routes for DNS forwarding. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4a64d2a603	net/dns: some post-review cleanups. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	720c1ad0f0	net/dns: insert OS base config when emulating split DNS. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e560be6443	net/dns: sort matchDomains to avoid test flake. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	68f76e9aa1	net/dns: add GetBaseConfig to OSConfigurator interface. Part of #953, required to make split DNS work on more basic platforms. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fe9cd61d71	net/dns: add tests for DNS config generation. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ba6d03768	net/dns/resolver: add a test helper to get at the resolver config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	da4cc8bbb4	net/dns: handle all possible translations of high-level DNS config. With this change, all OSes can sort-of do split DNS, except that the default upstream is hardcoded to 8.8.8.8 pending further plumbing. Additionally, Windows 8-10 can do split DNS fully correctly, without the 8.8.8.8 hack. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	e0e677a8f6	net/dns: split out search domains and match domains in OSConfig. It seems that all the setups that support split DNS understand this distinction, and it's an important one when translating high-level configuration. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a8dcda9c9a	net/dns: start of compat hacks for Windows 7. Correctly reports that Win7 cannot do split DNS, and has a helper to discover the "base" resolvers for the system. Part of #953 Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	3e915ac783	net/dns: implement OS-level split DNS for Windows. Part of #953. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c16a926bf2	net/dns: set OSConfig.Primary. OS implementations are going to support split DNS soon. Until they're all in place, hardcode Primary=true to get the old behavior. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	de6dc4c510	net/dns: add a Primary field to OSConfig. Currently ignored. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	b2a597b288	net/dns: rename Set to SetDNS in OSConfigurator. wgengine/router.CallbackRouter needs to support both the Router and OSConfigurator interfaces, so the setters can't both be called Set. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	7d84ee6c98	net/dns: unify the OS manager and internal resolver. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	1bf91c8123	net/dns/resolver: remove unused err return value. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6a206fd0fb	net/dns: rename impl to os. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c4530971db	net/dns/resolver: remove leftover debug print. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	4c61ebacf4	wgengine: move DNS configuration out of wgengine/router. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	748670f1e9	net/dns: fix typo in docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	a39d2403bc	net/dns: disable NetworkManager and resolved configurators temporarily. They need some rework to do the right thing, in the meantime the direct and resolvconf managers will work out. The resolved implementation was never selected due to control-side settings. The networkmanager implementation mostly doesn't get selected due to unforeseen interactions with `resolvconf` on many platforms. Both implementations also need rework to support the various routing modes they're capable of. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	befd8e4e68	net/dns: replace managerImpl with OSConfigurator in code. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	077d4dc8c7	net/dns: add an OSConfigurator interface. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6ad44f9fdf	wgengine: take in dns.Config, split out to resolver.Config and dns.OSConfig. Stepping stone towards having the DNS package handle the config splitting. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	2edb57dbf1	net/dns: add new Config that captures tailscale+OS DNS config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8af9d770cf	net/dns: rename Config to OSConfig. Making way for a new higher level config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	fcfc0d3a08	net/dns: remove ManagerConfig, pass relevant args directly. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	0ca04f1e01	net/dns: put noop.go back, limit with build tags for staticcheck. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	95470c3448	net/dns: remove Cleanup manager parameter. It's only use to skip some optional initialization during cleanup, but that work is very minor anyway, and about to change drastically. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cf361bb9b1	net/dns: remove PerDomain from Config. It's currently unused, and no longer makes sense with the upcoming DNS infrastructure. Keep it in tailcfg for now, since we need protocol compat for a bit longer. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f77ba75d6c	wgengine/router: move DNS cleanup into the DNS package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9f105d3968	net/dns/resolver: teach the forwarder to do per-domain routing. Given a DNS route map, the forwarder selects the right set of upstreams for a given name. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	90f82b6946	net/dns/resolver: add live reconfig, plumb through to ipnlocal. The resolver still only supports a single upstream config, and ipn/wgengine still have to split up the DNS config, but this moves closer to unifying the DNS configs. As a handy side-effect of the refactor, IPv6 MagicDNS records exist now. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	caeafc4a32	net/dns/resolver: fix package docstring. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	dbe4f6f42d	net/dns/resolver: unexport Resolve and ResolveReverse. They're only used internally and in tests, and have surprising semantics in that they only resolve MagicDNS names, not upstream resolver queries. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	cdeb8d6816	net/dns/resolver: fix staticcheck error. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	f185d62dc8	net/dns/resolver: unexport Packet, only use it internally. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	5fb9e00ecf	net/dns/resolver: remove Start method, fully spin up in New instead. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	075fb93e69	net/dns/resolver: remove the Config struct. In preparation for reintroducing a runtime reconfig Config struct. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	bc81dd4690	net/dns/resolver: rename ResolverConfig to just Config. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	d99f5b1596	net/dns/resolver: factor the resolver out into a sub-package. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	6521f02ff6	Move DNS flush logic to net/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	9f7f2af008	wgengine/router/dns: move to net/dns. Preparation for merging the APIs and whatnot. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	8432999835	Move wgengine/tsdns to net/dns. Straight move+fixup, no other changes. In prep for merging with wgengine/router/dns. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago

... 2 3 4 5 6

300 Commits (f46c1aede0472b6a71f1382169f6f19578c76610)