TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-29 04:55:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

tailcfg: break DERPNode.DERPTestPort into DERPPort & InsecureForTests

Browse Source 
The DERPTestPort int meant two things before: which port to use, and
whether to disable TLS verification. Users would like to set the port
without disabling TLS, so break it into two options.

Updates #1264

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick 2021-07-09 11:16:43 -07:00 committed by Brad Fitzpatrick
parent 92077ae78c
commit 7e7c4c1bbe
5 changed files with 41 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
derp/derphttp/derphttp_client.go
View File

@ -410,9 +410,7 @@ func (c *Client) dialRegion(ctx context.Context, reg *tailcfg.DERPRegion) (net.C
func (c *Client) tlsClient(nc net.Conn, node *tailcfg.DERPNode) *tls.Conn { func (c *Client) tlsClient(nc net.Conn, node *tailcfg.DERPNode) *tls.Conn {
tlsConf := tlsdial.Config(c.tlsServerName(node), c.TLSConfig) tlsConf := tlsdial.Config(c.tlsServerName(node), c.TLSConfig)
if node != nil { if node != nil {
if node.DERPTestPort != 0 { tlsConf.InsecureSkipVerify = node.InsecureForTests
tlsConf.InsecureSkipVerify = true
}
if node.CertName != "" { if node.CertName != "" {
tlsdial.SetConfigExpectedCert(tlsConf, node.CertName) tlsdial.SetConfigExpectedCert(tlsConf, node.CertName)
} }
@ -511,8 +509,8 @@ type res struct {
dst = n.HostName dst = n.HostName
} }
port := "443" port := "443"
if n.DERPTestPort != 0 { if n.DERPPort != 0 {
port = fmt.Sprint(n.DERPTestPort) port = fmt.Sprint(n.DERPPort)
} }
c, err := c.dialContext(ctx, proto, net.JoinHostPort(dst, port)) c, err := c.dialContext(ctx, proto, net.JoinHostPort(dst, port))
select { select {

13
tailcfg/derpmap.go
View File

@ -130,10 +130,15 @@ type DERPNode struct {
// server. // server.
STUNOnly bool `json:",omitempty"` STUNOnly bool `json:",omitempty"`
// DERPTestPort is used in tests to override the port, instead // DERPPort optionally provides an alternate TLS port number
// of using the default port of 443. If non-zero, TLS // for the DERP HTTPS server.
// verification is skipped. //
DERPTestPort int `json:",omitempty"` // If zero, 443 is used.
DERPPort int `json:",omitempty"`
// InsecureForTests is used by unit tests to disable TLS verification.
// It should not be set by users.
InsecureForTests bool `json:",omitempty"`
// STUNTestIP is used in tests to override the STUN server's IP. // STUNTestIP is used in tests to override the STUN server's IP.
// If empty, it's assumed to be the same as the DERP server. // If empty, it's assumed to be the same as the DERP server.

3
tailcfg/tailcfg_clone.go
View File

@ -335,7 +335,8 @@ func (src *DERPNode) Clone() *DERPNode {
IPv6 string IPv6 string
STUNPort int STUNPort int
STUNOnly bool STUNOnly bool
DERPTestPort int DERPPort int
InsecureForTests bool
STUNTestIP string STUNTestIP string
}{}) }{})

3
tstest/integration/integration.go
View File

@ -151,7 +151,8 @@ func RunDERPAndSTUN(t testing.TB, logf logger.Logf, ipAddress string) (derpMap *
IPv4: ipAddress, IPv4: ipAddress,
IPv6: "none", IPv6: "none",
STUNPort: stunAddr.Port, STUNPort: stunAddr.Port,
DERPTestPort: httpsrv.Listener.Addr().(*net.TCPAddr).Port, DERPPort: httpsrv.Listener.Addr().(*net.TCPAddr).Port,
InsecureForTests: true,
STUNTestIP: stunAddr.IP.String(), STUNTestIP: stunAddr.IP.String(),
}, },
}, },

3
wgengine/magicsock/magicsock_test.go
View File

@ -101,7 +101,8 @@ func runDERPAndStun(t *testing.T, logf logger.Logf, l nettype.PacketListener, st
IPv4: "127.0.0.1", IPv4: "127.0.0.1",
IPv6: "none", IPv6: "none",
STUNPort: stunAddr.Port, STUNPort: stunAddr.Port,
DERPTestPort: httpsrv.Listener.Addr().(*net.TCPAddr).Port, DERPPort: httpsrv.Listener.Addr().(*net.TCPAddr).Port,
InsecureForTests: true,
STUNTestIP: stunIP.String(), STUNTestIP: stunIP.String(),
}, },
}, },