We still try the host's x509 roots first, but if that fails (like if
the host is old), we fall back to using LetsEncrypt's root and
retrying with that.
tlsdial was used in the three main places: logs, control, DERP. But it
was missing in dnsfallback. So added it there too, so we can run fine
now on a machine with no DNS config and no root CAs configured.
Also, move SSLKEYLOGFILE support out of DERP. tlsdial is the logical place
for that support.
Fixes#1609
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
(cherry picked from commit 7cf8ec8108f4e26092bf07f698c8c5ce70d27d13)
This reverts the following commits:
8704fb308d6109baf9797231c09bcc6af9681771
afb95d7246b3f7776185abf0959544549d425f06
277bf8f48c0e52dd26b36a39ddf88b924927ee72
c995ac72a39dbc3a99ce7752f4a3c996f6fb7d99
e699226e802fed16e5af64d7eaa6c3c4537058bb
We're going to try again to build 1.14.1
Signed-off-by: Denton Gentry <dgentry@tailscale.com>
Move derpmap.Prod to a static JSON file (go:generate'd) instead,
to make its role explicit. And add a TODO about making dnsfallback
use an update-over-time DERP map file instead of a baked-in one.
Updates #1264
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
