You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/net/dns/resolver
Andrea Gottardo 6de6ab015f
net/dns: tweak DoH timeout, limit MaxConnsPerHost, require TLS 1.3 (#13564)
Updates tailscale/tailscale#6148

This is the result of some observations we made today with @raggi. The DNS over HTTPS client currently doesn't cap the number of connections it uses, either in-use or idle. A burst of DNS queries will open multiple connections. Idle connections remain open for 30 seconds (this interval is defined in the dohTransportTimeout constant). For DoH providers like NextDNS which send keep-alives, this means the cellular modem will remain up more than expected to send ACKs if any keep-alives are received while a connection remains idle during those 30 seconds. We can set the IdleConnTimeout to 10 seconds to ensure an idle connection is terminated if no other DNS queries come in after 10 seconds. Additionally, we can cap the number of connections to 1. This ensures that at all times there is only one open DoH connection, either active or idle. If idle, it will be terminated within 10 seconds from the last query.

We also observed all the DoH providers we support are capable of TLS 1.3. We can force this TLS version to reduce the number of packets sent/received each time a TLS connection is established.

Signed-off-by: Andrea Gottardo <andrea@gottardo.me>
4 weeks ago
..
debug.go all: use Go 1.22 range-over-int 7 months ago
doh_test.go net/dns/resolver: remove maxDoHInFlight 2 years ago
forwarder.go net/dns: tweak DoH timeout, limit MaxConnsPerHost, require TLS 1.3 (#13564) 4 weeks ago
forwarder_test.go net/dns/resolver: fix dns-sd NXDOMAIN responses from quad-100 1 month ago
macios_ext.go all: avoid repeated default interface lookups 2 years ago
tsdns.go cli: add `tailscale dns query` (#13368) 1 month ago
tsdns_server_test.go all: update copyright and license headers 2 years ago
tsdns_test.go net/dns, health: raise health warning for failing forwarded DNS queries (#12888) 3 months ago