You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Andrea Gottardo 6de6ab015f net/dns: tweak DoH timeout, limit MaxConnsPerHost, require TLS 1.3 (#13564) ... Updates tailscale/tailscale#6148 This is the result of some observations we made today with @raggi. The DNS over HTTPS client currently doesn't cap the number of connections it uses, either in-use or idle. A burst of DNS queries will open multiple connections. Idle connections remain open for 30 seconds (this interval is defined in the dohTransportTimeout constant). For DoH providers like NextDNS which send keep-alives, this means the cellular modem will remain up more than expected to send ACKs if any keep-alives are received while a connection remains idle during those 30 seconds. We can set the IdleConnTimeout to 10 seconds to ensure an idle connection is terminated if no other DNS queries come in after 10 seconds. Additionally, we can cap the number of connections to 1. This ensures that at all times there is only one open DoH connection, either active or idle. If idle, it will be terminated within 10 seconds from the last query. We also observed all the DoH providers we support are capable of TLS 1.3. We can force this TLS version to reduce the number of packets sent/received each time a TLS connection is established. Signed-off-by: Andrea Gottardo <andrea@gottardo.me>		3 weeks ago
..
art	all: fix new lint warnings from bumping staticcheck	2 months ago
captivedetection	net/captivedetection: set Timeout on net.Dialer (#13613)	3 weeks ago
connstats	all: use Go 1.22 range-over-int	6 months ago
dns	net/dns: tweak DoH timeout, limit MaxConnsPerHost, require TLS 1.3 (#13564)	3 weeks ago
dnscache	net/dnscache: don't fall back to an IPv6 dial if we don't have IPv6	3 weeks ago
dnsfallback	{control,net}: close idle connections of custom transports	3 months ago
flowtrack	net/flowtrack: fix, test String method	4 months ago
ipset	go.mod: bump bart	4 months ago
ktimeout	net/ktimeout: add a package to set TCP user timeout	8 months ago
memnet	net/memnet: export the network name (#9111)	1 year ago
netaddr	…
netcheck	net/netcheck,wgengine/magicsock: plumb OnlyTCP443 controlknob through netcheck (#13491)	1 month ago
neterror	…
netkernelconf	ipn/{ipnlocal,localapi},net/netkernelconf,client/tailscale,cmd/containerboot: optionally enable UDP GRO forwarding for containers (#12410)	5 months ago
netknob	…
netmon	all: fix new lint warnings from bumping staticcheck	2 months ago
netns	net/netns: remove some logspam by avoiding logging parse errors due to unspecified addresses	3 months ago
netstat	all: add test for package comments, fix, add comments as needed	4 months ago
netutil	{ipn,net,tsnet}: use tsaddr helpers	4 weeks ago
packet	wgengine/magicsock: actually use AF_PACKET socket for raw disco	2 months ago
ping	net/ping: fix ICMP echo code field to 0	1 year ago
portmapper	net/portmapper: don't treat 0.0.0.0 as a valid IP	3 weeks ago
proxymux	all: cleanup unused code, part 1 (#10661)	10 months ago
routetable	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	6 months ago
socks5	net/socks5: support UDP	3 months ago
sockstats	net/{interfaces,netmon}, all: merge net/interfaces package into net/netmon	6 months ago
speedtest	…
stun	ci: enable checklocks workflow for specific packages	4 months ago
stunserver	all: use Go 1.22 range-over-int	6 months ago
tcpinfo	all: use Go 1.22 range-over-int	6 months ago
tlsdial	cmd/tta, vnet: add host firewall, env var support, more tests	2 months ago
tsaddr	net/tsaddr: add WithoutExitRoutes and IsExitRoute	4 weeks ago
tsdial	{control,net}: close idle connections of custom transports	3 months ago
tshttpproxy	all: use Go 1.22 range-over-int	6 months ago
tstun	util/usermetrics: make usermetrics non-global	4 weeks ago
wsconn	go.{mod,sum}: migrate from nhooyr.io/websocket to github.com/coder/websocket	2 months ago