// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // The derper binary is a simple DERP server. package main // import "tailscale.com/cmd/derper" import ( "context" "crypto/tls" "encoding/json" "errors" "expvar" "flag" "fmt" "html" "io" "io/ioutil" "log" "net" "net/http" "os" "path/filepath" "regexp" "strings" "time" "golang.org/x/crypto/acme/autocert" "tailscale.com/atomicfile" "tailscale.com/derp" "tailscale.com/derp/derphttp" "tailscale.com/logpolicy" "tailscale.com/metrics" "tailscale.com/net/stun" "tailscale.com/tsweb" "tailscale.com/types/key" "tailscale.com/types/wgkey" "tailscale.com/version" ) var ( dev = flag.Bool("dev", false, "run in localhost development mode") addr = flag.String("a", ":443", "server address") configPath = flag.String("c", "", "config file path") certDir = flag.String("certdir", tsweb.DefaultCertDir("derper-certs"), "directory to store LetsEncrypt certs, if addr's port is :443") hostname = flag.String("hostname", "derp.tailscale.com", "LetsEncrypt host name, if addr's port is :443") logCollection = flag.String("logcollection", "", "If non-empty, logtail collection to log to") runSTUN = flag.Bool("stun", false, "also run a STUN server") meshPSKFile = flag.String("mesh-psk-file", defaultMeshPSKFile(), "if non-empty, path to file containing the mesh pre-shared key file. It should contain some hex string; whitespace is trimmed.") meshWith = flag.String("mesh-with", "", "optional comma-separated list of hostnames to mesh with; the server's own hostname can be in the list") bootstrapDNS = flag.String("bootstrap-dns-names", "", "optional comma-separated list of hostnames to make available at /bootstrap-dns") ) type config struct { PrivateKey wgkey.Private } func loadConfig() config { if *dev { return config{PrivateKey: mustNewKey()} } if *configPath == "" { log.Fatalf("derper: -c not specified") } b, err := ioutil.ReadFile(*configPath) switch { case errors.Is(err, os.ErrNotExist): return writeNewConfig() case err != nil: log.Fatal(err) panic("unreachable") default: var cfg config if err := json.Unmarshal(b, &cfg); err != nil { log.Fatalf("derper: config: %v", err) } return cfg } } func mustNewKey() wgkey.Private { key, err := wgkey.NewPrivate() if err != nil { log.Fatal(err) } return key } func writeNewConfig() config { key := mustNewKey() if err := os.MkdirAll(filepath.Dir(*configPath), 0777); err != nil { log.Fatal(err) } cfg := config{ PrivateKey: key, } b, err := json.MarshalIndent(cfg, "", "\t") if err != nil { log.Fatal(err) } if err := atomicfile.WriteFile(*configPath, b, 0600); err != nil { log.Fatal(err) } return cfg } func main() { flag.Parse() if *dev { *logCollection = "" *addr = ":3340" // above the keys DERP log.Printf("Running in dev mode.") tsweb.DevMode = true } var logPol *logpolicy.Policy if *logCollection != "" { logPol = logpolicy.New(*logCollection) log.SetOutput(logPol.Logtail) } cfg := loadConfig() letsEncrypt := tsweb.IsProd443(*addr) s := derp.NewServer(key.Private(cfg.PrivateKey), log.Printf) if *meshPSKFile != "" { b, err := ioutil.ReadFile(*meshPSKFile) if err != nil { log.Fatal(err) } key := strings.TrimSpace(string(b)) if matched, _ := regexp.MatchString(`(?i)^[0-9a-f]{64,}$`, key); !matched { log.Fatalf("key in %s must contain 64+ hex digits", *meshPSKFile) } s.SetMeshKey(key) log.Printf("DERP mesh key configured") } if err := startMesh(s); err != nil { log.Fatalf("startMesh: %v", err) } expvar.Publish("derp", s.ExpVar()) // Create our own mux so we don't expose /debug/ stuff to the world. mux := tsweb.NewMux(debugHandler(s)) mux.Handle("/derp", derphttp.Handler(s)) go refreshBootstrapDNSLoop() mux.HandleFunc("/bootstrap-dns", handleBootstrapDNS) mux.Handle("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html; charset=utf-8") w.WriteHeader(200) io.WriteString(w, `

DERP

This is a Tailscale DERP server.

`) if tsweb.AllowDebugAccess(r) { io.WriteString(w, "

Debug info at /debug/.

\n") } })) if *runSTUN { go serveSTUN() } httpsrv := &http.Server{ Addr: *addr, Handler: mux, } var err error if letsEncrypt { if *certDir == "" { log.Fatalf("missing required --certdir flag") } log.Printf("derper: serving on %s with TLS", *addr) certManager := &autocert.Manager{ Prompt: autocert.AcceptTOS, HostPolicy: autocert.HostWhitelist(*hostname), Cache: autocert.DirCache(*certDir), } if *hostname == "derp.tailscale.com" { certManager.HostPolicy = prodAutocertHostPolicy certManager.Email = "security@tailscale.com" } httpsrv.TLSConfig = certManager.TLSConfig() letsEncryptGetCert := httpsrv.TLSConfig.GetCertificate httpsrv.TLSConfig.GetCertificate = func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) { cert, err := letsEncryptGetCert(hi) if err != nil { return nil, err } cert.Certificate = append(cert.Certificate, s.MetaCert()) return cert, nil } go func() { err := http.ListenAndServe(":80", certManager.HTTPHandler(tsweb.Port80Handler{Main: mux})) if err != nil { if err != http.ErrServerClosed { log.Fatal(err) } } }() err = httpsrv.ListenAndServeTLS("", "") } else { log.Printf("derper: serving on %s", *addr) err = httpsrv.ListenAndServe() } if err != nil && err != http.ErrServerClosed { log.Fatalf("derper: %v", err) } } func debugHandler(s *derp.Server) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.RequestURI == "/debug/check" { err := s.ConsistencyCheck() if err != nil { http.Error(w, err.Error(), 500) } else { io.WriteString(w, "derp.Server ConsistencyCheck okay") } return } f := func(format string, args ...interface{}) { fmt.Fprintf(w, format, args...) } f(`

DERP debug