1
0
mirror of https://github.com/juanfont/headscale.git synced 2024-12-20 19:09:07 +01:00
juanfont.headscale/derp_server.go

290 lines
7.5 KiB
Go
Raw Normal View History

package headscale
import (
"context"
2022-06-18 19:51:37 +02:00
"encoding/json"
"fmt"
"net"
"net/http"
2022-09-02 09:16:19 +02:00
"net/netip"
"net/url"
"strconv"
"strings"
"time"
"github.com/rs/zerolog/log"
"tailscale.com/derp"
"tailscale.com/net/stun"
"tailscale.com/tailcfg"
"tailscale.com/types/key"
)
// fastStartHeader is the header (with value "1") that signals to the HTTP
// server that the DERP HTTP client does not want the HTTP 101 response
// headers and it will begin writing & reading the DERP protocol immediately
// following its HTTP request.
const fastStartHeader = "Derp-Fast-Start"
2022-03-05 19:30:30 +01:00
type DERPServer struct {
2022-03-04 11:31:41 +01:00
tailscaleDERP *derp.Server
region tailcfg.DERPRegion
}
2022-03-05 19:30:30 +01:00
func (h *Headscale) NewDERPServer() (*DERPServer, error) {
2022-06-20 12:32:13 +02:00
log.Trace().Caller().Msg("Creating new embedded DERP server")
2022-03-06 17:35:54 +01:00
server := derp.NewServer(key.NodePrivate(*h.privateKey), log.Info().Msgf)
region, err := h.generateRegionLocalDERP()
if err != nil {
return nil, err
}
2022-03-06 17:35:54 +01:00
return &DERPServer{server, region}, nil
}
func (h *Headscale) generateRegionLocalDERP() (tailcfg.DERPRegion, error) {
serverURL, err := url.Parse(h.cfg.ServerURL)
if err != nil {
return tailcfg.DERPRegion{}, err
}
var host string
var port int
host, portStr, err := net.SplitHostPort(serverURL.Host)
if err != nil {
if serverURL.Scheme == "https" {
host = serverURL.Host
port = 443
} else {
host = serverURL.Host
port = 80
}
} else {
port, err = strconv.Atoi(portStr)
if err != nil {
return tailcfg.DERPRegion{}, err
}
}
localDERPregion := tailcfg.DERPRegion{
2022-03-06 17:25:21 +01:00
RegionID: h.cfg.DERP.ServerRegionID,
RegionCode: h.cfg.DERP.ServerRegionCode,
RegionName: h.cfg.DERP.ServerRegionName,
Avoid: false,
Nodes: []*tailcfg.DERPNode{
{
2022-03-06 17:25:21 +01:00
Name: fmt.Sprintf("%d", h.cfg.DERP.ServerRegionID),
RegionID: h.cfg.DERP.ServerRegionID,
HostName: host,
DERPPort: port,
},
},
}
2022-03-06 17:00:56 +01:00
_, portSTUNStr, err := net.SplitHostPort(h.cfg.DERP.STUNAddr)
if err != nil {
return tailcfg.DERPRegion{}, err
}
portSTUN, err := strconv.Atoi(portSTUNStr)
if err != nil {
return tailcfg.DERPRegion{}, err
2022-03-06 17:00:56 +01:00
}
localDERPregion.Nodes[0].STUNPort = portSTUN
2022-03-06 17:00:56 +01:00
2022-06-20 12:32:13 +02:00
log.Info().Caller().Msgf("DERP region: %+v", localDERPregion)
2022-06-26 11:43:17 +02:00
return localDERPregion, nil
}
2022-06-18 18:41:42 +02:00
func (h *Headscale) DERPHandler(
2022-06-26 11:55:37 +02:00
writer http.ResponseWriter,
req *http.Request,
2022-06-18 18:41:42 +02:00
) {
2022-06-26 11:55:37 +02:00
log.Trace().Caller().Msgf("/derp request from %v", req.RemoteAddr)
up := strings.ToLower(req.Header.Get("Upgrade"))
if up != "websocket" && up != "derp" {
if up != "" {
log.Warn().Caller().Msgf("Weird websockets connection upgrade: %q", up)
}
2022-06-26 11:55:37 +02:00
writer.Header().Set("Content-Type", "text/plain")
writer.WriteHeader(http.StatusUpgradeRequired)
2022-06-26 12:21:35 +02:00
_, err := writer.Write([]byte("DERP requires connection upgrade"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2022-03-06 17:35:54 +01:00
return
}
2022-06-26 11:55:37 +02:00
fastStart := req.Header.Get(fastStartHeader) == "1"
2022-06-26 11:55:37 +02:00
hijacker, ok := writer.(http.Hijacker)
if !ok {
log.Error().Caller().Msg("DERP requires Hijacker interface from Gin")
2022-06-26 11:55:37 +02:00
writer.Header().Set("Content-Type", "text/plain")
writer.WriteHeader(http.StatusInternalServerError)
2022-06-26 12:21:35 +02:00
_, err := writer.Write([]byte("HTTP does not support general TCP support"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2022-03-06 17:25:21 +01:00
return
}
netConn, conn, err := hijacker.Hijack()
if err != nil {
log.Error().Caller().Err(err).Msgf("Hijack failed")
2022-06-26 11:55:37 +02:00
writer.Header().Set("Content-Type", "text/plain")
writer.WriteHeader(http.StatusInternalServerError)
2022-06-26 12:21:35 +02:00
_, err = writer.Write([]byte("HTTP does not support general TCP support"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
2022-03-06 17:25:21 +01:00
return
}
2022-06-26 11:55:37 +02:00
log.Trace().Caller().Msgf("Hijacked connection from %v", req.RemoteAddr)
if !fastStart {
pubKey := h.privateKey.Public()
2022-05-16 14:59:46 +02:00
pubKeyStr := pubKey.UntypedHexString() // nolint
fmt.Fprintf(conn, "HTTP/1.1 101 Switching Protocols\r\n"+
"Upgrade: DERP\r\n"+
"Connection: Upgrade\r\n"+
"Derp-Version: %v\r\n"+
"Derp-Public-Key: %s\r\n\r\n",
derp.ProtocolVersion,
2022-03-06 17:35:54 +01:00
pubKeyStr)
}
2022-09-02 09:16:19 +02:00
h.DERPServer.tailscaleDERP.Accept(req.Context(), netConn, conn, netConn.RemoteAddr().String())
}
2022-03-05 19:30:30 +01:00
// DERPProbeHandler is the endpoint that js/wasm clients hit to measure
// DERP latency, since they can't do UDP STUN queries.
2022-06-18 18:41:42 +02:00
func (h *Headscale) DERPProbeHandler(
2022-06-26 11:43:17 +02:00
writer http.ResponseWriter,
req *http.Request,
2022-06-18 18:41:42 +02:00
) {
2022-06-26 11:43:17 +02:00
switch req.Method {
case "HEAD", "GET":
2022-06-26 11:43:17 +02:00
writer.Header().Set("Access-Control-Allow-Origin", "*")
writer.WriteHeader(http.StatusOK)
default:
2022-06-26 11:43:17 +02:00
writer.WriteHeader(http.StatusMethodNotAllowed)
2022-06-26 12:21:35 +02:00
_, err := writer.Write([]byte("bogus probe method"))
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
}
}
2022-03-06 01:23:35 +01:00
// DERPBootstrapDNSHandler implements the /bootsrap-dns endpoint
// Described in https://github.com/tailscale/tailscale/issues/1405,
// this endpoint provides a way to help a client when it fails to start up
// because its DNS are broken.
// The initial implementation is here https://github.com/tailscale/tailscale/pull/1406
// They have a cache, but not clear if that is really necessary at Headscale, uh, scale.
2022-03-06 17:00:56 +01:00
// An example implementation is found here https://derp.tailscale.com/bootstrap-dns
2022-06-18 18:41:42 +02:00
func (h *Headscale) DERPBootstrapDNSHandler(
2022-06-26 11:43:17 +02:00
writer http.ResponseWriter,
req *http.Request,
2022-06-18 18:41:42 +02:00
) {
2022-03-06 01:23:35 +01:00
dnsEntries := make(map[string][]net.IP)
resolvCtx, cancel := context.WithTimeout(context.Background(), time.Minute)
defer cancel()
2022-06-18 18:41:42 +02:00
var resolver net.Resolver
2022-03-06 01:23:35 +01:00
for _, region := range h.DERPMap.Regions {
for _, node := range region.Nodes { // we don't care if we override some nodes
2022-06-18 18:41:42 +02:00
addrs, err := resolver.LookupIP(resolvCtx, "ip", node.HostName)
2022-03-06 01:23:35 +01:00
if err != nil {
2022-04-15 18:27:57 +02:00
log.Trace().
Caller().
Err(err).
Msgf("bootstrap DNS lookup failed %q", node.HostName)
2022-03-06 17:35:54 +01:00
2022-03-06 01:23:35 +01:00
continue
}
dnsEntries[node.HostName] = addrs
}
}
2022-06-26 11:43:17 +02:00
writer.Header().Set("Content-Type", "application/json")
writer.WriteHeader(http.StatusOK)
2022-06-26 12:21:35 +02:00
err := json.NewEncoder(writer).Encode(dnsEntries)
if err != nil {
log.Error().
Caller().
Err(err).
Msg("Failed to write response")
}
}
2022-03-06 17:25:21 +01:00
// ServeSTUN starts a STUN server on the configured addr.
func (h *Headscale) ServeSTUN() {
2022-03-06 17:00:56 +01:00
packetConn, err := net.ListenPacket("udp", h.cfg.DERP.STUNAddr)
if err != nil {
log.Fatal().Msgf("failed to open STUN listener: %v", err)
}
2022-03-06 17:00:56 +01:00
log.Info().Msgf("STUN server started at %s", packetConn.LocalAddr())
2022-03-06 17:35:54 +01:00
udpConn, ok := packetConn.(*net.UDPConn)
if !ok {
log.Fatal().Msg("STUN listener is not a UDP listener")
}
serverSTUNListener(context.Background(), udpConn)
}
2022-03-06 17:35:54 +01:00
func serverSTUNListener(ctx context.Context, packetConn *net.UDPConn) {
var buf [64 << 10]byte
var (
2022-03-06 17:35:54 +01:00
bytesRead int
udpAddr *net.UDPAddr
err error
)
for {
2022-03-06 17:35:54 +01:00
bytesRead, udpAddr, err = packetConn.ReadFromUDP(buf[:])
if err != nil {
if ctx.Err() != nil {
return
}
2022-03-05 19:30:30 +01:00
log.Error().Caller().Err(err).Msgf("STUN ReadFrom")
time.Sleep(time.Second)
2022-03-06 17:35:54 +01:00
continue
}
2022-03-06 17:35:54 +01:00
log.Trace().Caller().Msgf("STUN request from %v", udpAddr)
pkt := buf[:bytesRead]
if !stun.Is(pkt) {
2022-03-08 12:11:51 +01:00
log.Trace().Caller().Msgf("UDP packet is not STUN")
continue
}
txid, err := stun.ParseBindingRequest(pkt)
if err != nil {
2022-03-08 12:11:51 +01:00
log.Trace().Caller().Err(err).Msgf("STUN parse error")
continue
}
2022-09-02 09:16:19 +02:00
addr, _ := netip.AddrFromSlice(udpAddr.IP)
res := stun.Response(txid, netip.AddrPortFrom(addr, uint16(udpAddr.Port)))
2022-03-06 17:35:54 +01:00
_, err = packetConn.WriteTo(res, udpAddr)
if err != nil {
2022-03-08 12:11:51 +01:00
log.Trace().Caller().Err(err).Msgf("Issue writing to UDP")
2022-03-06 17:35:54 +01:00
continue
}
}
}