From 6ffea2225ddf5d47534b1b942a38b60044c042e3 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 15:28:19 +0100 Subject: [PATCH 01/14] Attempt to close failed streams If we have a failed write toward any of our connections, attempt to close the connection by returning "false" as in unsuccessful stream --- machine.go | 1 + poll.go | 9 ++++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/machine.go b/machine.go index 1d4939c1..2d4bb518 100644 --- a/machine.go +++ b/machine.go @@ -309,6 +309,7 @@ func (h *Headscale) notifyChangesToPeers(m *Machine) { Str("machine", m.Name). Str("peer", p.Name). Msgf("Peer %s does not appear to be polling", p.Name) + return } log.Trace(). Str("func", "notifyChangesToPeers"). diff --git a/poll.go b/poll.go index 60bfa9ea..c5da3a96 100644 --- a/poll.go +++ b/poll.go @@ -230,6 +230,7 @@ func (h *Headscale) PollNetMapStream( Str("channel", "pollData"). Err(err). Msg("Cannot write data") + return false } log.Trace(). Str("handler", "PollNetMapStream"). @@ -237,7 +238,7 @@ func (h *Headscale) PollNetMapStream( Str("channel", "pollData"). Int("bytes", len(data)). Msg("Data from pollData channel written successfully") - // TODO: Abstract away all the database calls, this can cause race conditions + // TODO(kradalby): Abstract away all the database calls, this can cause race conditions // when an outdated machine object is kept alive, e.g. db is update from // command line, but then overwritten. err = h.UpdateMachine(&m) @@ -276,6 +277,7 @@ func (h *Headscale) PollNetMapStream( Str("channel", "keepAlive"). Err(err). Msg("Cannot write keep alive message") + return false } log.Trace(). Str("handler", "PollNetMapStream"). @@ -283,7 +285,7 @@ func (h *Headscale) PollNetMapStream( Str("channel", "keepAlive"). Int("bytes", len(data)). Msg("Keep alive sent successfully") - // TODO: Abstract away all the database calls, this can cause race conditions + // TODO(kradalby): Abstract away all the database calls, this can cause race conditions // when an outdated machine object is kept alive, e.g. db is update from // command line, but then overwritten. err = h.UpdateMachine(&m) @@ -336,6 +338,7 @@ func (h *Headscale) PollNetMapStream( Str("channel", "update"). Err(err). Msg("Could not write the map response") + return false } log.Trace(). Str("handler", "PollNetMapStream"). @@ -347,7 +350,7 @@ func (h *Headscale) PollNetMapStream( // we sometimes end in a state were the update // is not picked up by a client and we use this // to determine if we should "force" an update. - // TODO: Abstract away all the database calls, this can cause race conditions + // TODO(kradalby): Abstract away all the database calls, this can cause race conditions // when an outdated machine object is kept alive, e.g. db is update from // command line, but then overwritten. err = h.UpdateMachine(&m) From ed728f57e06568eb4b618610fd353b4b9fe02a36 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 15:29:27 +0100 Subject: [PATCH 02/14] Remove WriteTimeout from HTTP Golangs built in HTTP server does not allow different HTTP timeout for different types of handlers, so we cannot have a write timeout as we attempt to do long polling (my bad). See linked article. Also removed redundant server declaration --- app.go | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/app.go b/app.go index dc398eb7..8be137cf 100644 --- a/app.go +++ b/app.go @@ -172,16 +172,18 @@ func (h *Headscale) Serve() error { r.GET("/apple/:platform", h.ApplePlatformConfig) var err error - timeout := 30 * time.Second - go h.watchForKVUpdates(5000) go h.expireEphemeralNodes(5000) s := &http.Server{ - Addr: h.cfg.Addr, - Handler: r, - ReadTimeout: timeout, - WriteTimeout: timeout, + Addr: h.cfg.Addr, + Handler: r, + ReadTimeout: 30 * time.Second, + // Go does not handle timeouts in HTTP very well, and there is + // no good way to handle streaming timeouts, therefore we need to + // keep this at unlimited and be careful to clean up connections + // https://blog.cloudflare.com/the-complete-guide-to-golang-net-http-timeouts/#aboutstreaming + WriteTimeout: 0, } if h.cfg.TLSLetsEncryptHostname != "" { @@ -194,13 +196,9 @@ func (h *Headscale) Serve() error { HostPolicy: autocert.HostWhitelist(h.cfg.TLSLetsEncryptHostname), Cache: autocert.DirCache(h.cfg.TLSLetsEncryptCacheDir), } - s := &http.Server{ - Addr: h.cfg.Addr, - TLSConfig: m.TLSConfig(), - Handler: r, - ReadTimeout: timeout, - WriteTimeout: timeout, - } + + s.TLSConfig = m.TLSConfig() + if h.cfg.TLSLetsEncryptChallengeType == "TLS-ALPN-01" { // Configuration via autocert with TLS-ALPN-01 (https://tools.ietf.org/html/rfc8737) // The RFC requires that the validation is done on port 443; in other words, headscale @@ -211,7 +209,6 @@ func (h *Headscale) Serve() error { // port 80 for the certificate validation in addition to the headscale // service, which can be configured to run on any other port. go func() { - log.Fatal(). Err(http.ListenAndServe(h.cfg.TLSLetsEncryptListen, m.HTTPHandler(http.HandlerFunc(h.redirect)))). Msg("failed to set up a HTTP server") From cefe2d5bccda4ad0a6d36f70c3466bff79bcacfa Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 15:30:41 +0100 Subject: [PATCH 03/14] Improve and clarify log entry --- poll.go | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/poll.go b/poll.go index c5da3a96..33b4b124 100644 --- a/poll.go +++ b/poll.go @@ -259,7 +259,7 @@ func (h *Headscale) PollNetMapStream( Str("machine", m.Name). Str("channel", "pollData"). Int("bytes", len(data)). - Msg("Machine updated successfully after sending pollData") + Msg("Machine entry in database updated successfully after sending pollData") return true case data := <-keepAliveChan: @@ -396,13 +396,33 @@ func (h *Headscale) PollNetMapStream( m.LastSeen = &now h.db.Save(&m) + log.Trace(). + Str("handler", "PollNetMapStream"). + Str("machine", m.Name). + Str("channel", "Done"). + Msg("Canceling keepAlive channel") cancelKeepAlive <- struct{}{} + log.Trace(). + Str("handler", "PollNetMapStream"). + Str("machine", m.Name). + Str("channel", "Done"). + Msg("Closing update channel") h.closeUpdateChannel(&m) close(pollDataChan) + log.Trace(). + Str("handler", "PollNetMapStream"). + Str("machine", m.Name). + Str("channel", "Done"). + Msg("Closing pollData channel") close(keepAliveChan) + log.Trace(). + Str("handler", "PollNetMapStream"). + Str("machine", m.Name). + Str("channel", "Done"). + Msg("Closing keepAliveChan channel") return false } From 39abc4e97317b64597147200ed313216c86e24d5 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 15:38:53 +0100 Subject: [PATCH 04/14] Clarify error messages for nodes that are not connected If a node does not have an update channel, it is probably not connected, clarify the log messages and make sure we dont print that it was updated successfully (continue, not return) --- machine.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/machine.go b/machine.go index 2d4bb518..1cd2d95f 100644 --- a/machine.go +++ b/machine.go @@ -308,8 +308,8 @@ func (h *Headscale) notifyChangesToPeers(m *Machine) { Str("func", "notifyChangesToPeers"). Str("machine", m.Name). Str("peer", p.Name). - Msgf("Peer %s does not appear to be polling", p.Name) - return + Msgf("Peer %s does not have an open update client, skipping.", p.Name) + continue } log.Trace(). Str("func", "notifyChangesToPeers"). @@ -380,11 +380,12 @@ func (h *Headscale) sendRequestOnUpdateChannel(m *tailcfg.Node) error { Msgf("Notified machine %s", m.Name) } } else { + err := errors.New("machine does not have an open update channel") log.Info(). Str("func", "requestUpdate"). Str("machine", m.Name). - Msgf("Machine %s does not appear to be polling", m.Name) - return errors.New("machine does not seem to be polling") + Msgf("Machine %s does not have an open update channel", m.Name) + return err } return nil } From 0435089ebabd5a1b14c6f87c097e65b956ca22dc Mon Sep 17 00:00:00 2001 From: Ward Vandewege Date: Sat, 2 Oct 2021 10:44:52 -0400 Subject: [PATCH 05/14] Fix a few typos in the tailscale command line arguments. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 8dd9c8d6..45c648ac 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ Suggestions/PRs welcomed! 7. Add your first machine ```shell - tailscale up -login-server YOUR_HEADSCALE_URL + tailscale up --login-server YOUR_HEADSCALE_URL ``` 8. Navigate to the URL you will get with `tailscale up`, where you'll find your machine key. @@ -154,7 +154,7 @@ Alternatively, you can use Auth Keys to register your machines: 2. Use the authkey from your machine to register it ```shell - tailscale up -login-server YOUR_HEADSCALE_URL --authkey YOURAUTHKEY + tailscale up --login-server YOUR_HEADSCALE_URL --authkey YOURAUTHKEY ``` If you create an authkey with the `--ephemeral` flag, that key will create ephemeral nodes. This implies that `--reusable` is true. From 54daa0da23e44a5f9836485ae9e0e9582c7347a8 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 17:35:39 +0100 Subject: [PATCH 06/14] Fix spelling error --- poll.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/poll.go b/poll.go index 33b4b124..73726610 100644 --- a/poll.go +++ b/poll.go @@ -400,7 +400,7 @@ func (h *Headscale) PollNetMapStream( Str("handler", "PollNetMapStream"). Str("machine", m.Name). Str("channel", "Done"). - Msg("Canceling keepAlive channel") + Msg("Cancelling keepAlive channel") cancelKeepAlive <- struct{}{} log.Trace(). From 78a0f3ca37e140f227cfd9c28331f32dff945fe4 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 18:39:09 +0100 Subject: [PATCH 07/14] Up ping timeout --- integration_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration_test.go b/integration_test.go index f62ca1da..925fc4ca 100644 --- a/integration_test.go +++ b/integration_test.go @@ -433,7 +433,7 @@ func (s *IntegrationTestSuite) TestPingAllPeers() { command := []string{ "tailscale", "ping", "--timeout=1s", - "--c=20", + "--c=100", "--until-direct=true", ip.String(), } From d637a9c3024160b81b25047b92d7c2757ba3c1bf Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 2 Oct 2021 22:56:48 +0100 Subject: [PATCH 08/14] Change ping count --- integration_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration_test.go b/integration_test.go index 925fc4ca..b768fa59 100644 --- a/integration_test.go +++ b/integration_test.go @@ -433,7 +433,7 @@ func (s *IntegrationTestSuite) TestPingAllPeers() { command := []string{ "tailscale", "ping", "--timeout=1s", - "--c=100", + "--c=10", "--until-direct=true", ip.String(), } From 1d81333685d06d15b93ef693970899ad784da7d6 Mon Sep 17 00:00:00 2001 From: Ward Vandewege Date: Sun, 3 Oct 2021 12:06:50 -0400 Subject: [PATCH 09/14] Make sure that goreleaser uses the appropriate version string when building the headscale executable. --- .goreleaser.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.goreleaser.yml b/.goreleaser.yml index fd25563c..7b1ea605 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -19,7 +19,7 @@ builds: flags: - -mod=readonly ldflags: - - -s -w -X main.version={{.Version}} + - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}} - id: linux-armhf main: ./cmd/headscale/headscale.go mod_timestamp: '{{ .CommitTimestamp }}' @@ -39,7 +39,7 @@ builds: flags: - -mod=readonly ldflags: - - -s -w -X main.version={{.Version}} + - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}} - id: linux-amd64 @@ -54,6 +54,8 @@ builds: - 7 main: ./cmd/headscale/headscale.go mod_timestamp: '{{ .CommitTimestamp }}' + ldflags: + - -s -w -X github.com/juanfont/headscale/cmd/headscale/cli.Version=v{{.Version}} archives: - id: golang-cross From 8fa0fe65bacc000eac3a876e0dece01e42be55b4 Mon Sep 17 00:00:00 2001 From: Aaron Bieber Date: Sun, 3 Oct 2021 12:26:38 -0600 Subject: [PATCH 10/14] Add the ability to specify registration ACME email and ACME URL. --- app.go | 8 ++++++++ cmd/headscale/cli/utils.go | 3 +++ config.json.postgres.example | 2 ++ config.json.sqlite.example | 2 ++ 4 files changed, 15 insertions(+) diff --git a/app.go b/app.go index 8be137cf..1e6b7bcf 100644 --- a/app.go +++ b/app.go @@ -12,6 +12,7 @@ import ( "github.com/rs/zerolog/log" "github.com/gin-gonic/gin" + "golang.org/x/crypto/acme" "golang.org/x/crypto/acme/autocert" "gorm.io/gorm" "inet.af/netaddr" @@ -44,6 +45,9 @@ type Config struct { TLSCertPath string TLSKeyPath string + ACMEURL string + ACMEEmail string + DNSConfig *tailcfg.DNSConfig } @@ -195,6 +199,10 @@ func (h *Headscale) Serve() error { Prompt: autocert.AcceptTOS, HostPolicy: autocert.HostWhitelist(h.cfg.TLSLetsEncryptHostname), Cache: autocert.DirCache(h.cfg.TLSLetsEncryptCacheDir), + Client: &acme.Client{ + DirectoryURL: h.cfg.ACMEURL, + }, + Email: h.cfg.ACMEEmail, } s.TLSConfig = m.TLSConfig() diff --git a/cmd/headscale/cli/utils.go b/cmd/headscale/cli/utils.go index 7ada6693..ac739a02 100644 --- a/cmd/headscale/cli/utils.go +++ b/cmd/headscale/cli/utils.go @@ -169,6 +169,9 @@ func getHeadscaleApp() (*headscale.Headscale, error) { TLSCertPath: absPath(viper.GetString("tls_cert_path")), TLSKeyPath: absPath(viper.GetString("tls_key_path")), + ACMEEmail: absPath(viper.GetString("acme_email")), + ACMEURL: absPath(viper.GetString("acme_url")), + DNSConfig: GetDNSConfig(), } diff --git a/config.json.postgres.example b/config.json.postgres.example index aba72063..e9118204 100644 --- a/config.json.postgres.example +++ b/config.json.postgres.example @@ -10,6 +10,8 @@ "db_name": "headscale", "db_user": "foo", "db_pass": "bar", + "acme_url": "https://acme-v02.api.letsencrypt.org/directory", + "acme_email": "", "tls_letsencrypt_hostname": "", "tls_letsencrypt_listen": ":http", "tls_letsencrypt_cache_dir": ".cache", diff --git a/config.json.sqlite.example b/config.json.sqlite.example index b22e5ace..5afa450f 100644 --- a/config.json.sqlite.example +++ b/config.json.sqlite.example @@ -6,6 +6,8 @@ "ephemeral_node_inactivity_timeout": "30m", "db_type": "sqlite3", "db_path": "db.sqlite", + "acme_url": "https://acme-v02.api.letsencrypt.org/directory", + "acme_email": "", "tls_letsencrypt_hostname": "", "tls_letsencrypt_listen": ":http", "tls_letsencrypt_cache_dir": ".cache", From 817cc1e567624f365f014bd31b985b509fa358b5 Mon Sep 17 00:00:00 2001 From: Aaron Bieber Date: Sun, 3 Oct 2021 14:02:44 -0600 Subject: [PATCH 11/14] these are not files! --- cmd/headscale/cli/utils.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmd/headscale/cli/utils.go b/cmd/headscale/cli/utils.go index ac739a02..ca09bf51 100644 --- a/cmd/headscale/cli/utils.go +++ b/cmd/headscale/cli/utils.go @@ -169,8 +169,8 @@ func getHeadscaleApp() (*headscale.Headscale, error) { TLSCertPath: absPath(viper.GetString("tls_cert_path")), TLSKeyPath: absPath(viper.GetString("tls_key_path")), - ACMEEmail: absPath(viper.GetString("acme_email")), - ACMEURL: absPath(viper.GetString("acme_url")), + ACMEEmail: viper.GetString("acme_email"), + ACMEURL: viper.GetString("acme_url"), DNSConfig: GetDNSConfig(), } From 566c2bc1fb1e73a84c85f147c8dc39994a8e8f9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20T=C3=B6tterman?= Date: Mon, 4 Oct 2021 14:58:36 +0300 Subject: [PATCH 12/14] Document client OS support in a table --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index 45c648ac..766e9465 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,16 @@ Headscale implements this coordination server. - [x] Share nodes between ~~users~~ namespaces - [ ] MagicDNS / Smart DNS +## Client OS support + +| OS | Supports headscale | +| --- | --- | +| Linux | Yes | +| macOS | Yes | +| Windows | Yes | +| Android | [You need to compile the client yourself](https://github.com/juanfont/headscale/issues/58#issuecomment-885255270) | +| iOS | Not yet | + ## Roadmap 🤷 Suggestions/PRs welcomed! From fcc6991d627c27ba56d8a88e4965c9e0118dda15 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20T=C3=B6tterman?= Date: Mon, 4 Oct 2021 17:23:31 +0300 Subject: [PATCH 13/14] Update README.md Co-authored-by: Kristoffer Dalby --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 766e9465..5c3cc54d 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,7 @@ Headscale implements this coordination server. | OS | Supports headscale | | --- | --- | | Linux | Yes | +| OpenBSD | Yes | | macOS | Yes | | Windows | Yes | | Android | [You need to compile the client yourself](https://github.com/juanfont/headscale/issues/58#issuecomment-885255270) | From ed0b31d0727cccd1290dff3299f3bfee910d4ef1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20T=C3=B6tterman?= Date: Mon, 4 Oct 2021 17:23:38 +0300 Subject: [PATCH 14/14] Update README.md Co-authored-by: Kristoffer Dalby --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5c3cc54d..5f691a6c 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ Headscale implements this coordination server. | --- | --- | | Linux | Yes | | OpenBSD | Yes | -| macOS | Yes | +| macOS | Yes (see `/apple` on your headscale for more information) | | Windows | Yes | | Android | [You need to compile the client yourself](https://github.com/juanfont/headscale/issues/58#issuecomment-885255270) | | iOS | Not yet |