lzc256
/
tailscale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

derp/derphttp: pass `*tls.Config` to WebSocket connections 

Signed-off-by: Kyle Carberry <kyle@carberry.com>
pull/7401/head
Kyle Carberry 2023-02-28 15:02:10 -06:00
parent e3211ff88b
commit 1bf230348c
2 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
derp/derphttp/derphttp_client.go
View File

@ -188,6 +188,9 @@ func (c *Client) tlsServerName(node *tailcfg.DERPNode) string {
if c.url != nil {
return c.url.Host
}
if node == nil {
return ""
}
return node.HostName
}
@ -225,7 +228,7 @@ func (c *Client) preferIPv6() bool {
}
// dialWebsocketFunc is non-nil (set by websocket.go's init) when compiled in.
var dialWebsocketFunc func(ctx context.Context, urlStr string) (net.Conn, error)
var dialWebsocketFunc func(ctx context.Context, urlStr string, tlsConfig *tls.Config) (net.Conn, error)
func useWebsockets() bool {
if runtime.GOOS == "js" {
@ -292,13 +295,16 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
switch {
case useWebsockets():
var urlStr string
var tlsConfig *tls.Config
if c.url != nil {
urlStr = c.url.String()
tlsConfig = c.tlsConfig(nil)
} else {
urlStr = c.urlString(reg.Nodes[0])
tlsConfig = c.tlsConfig(reg.Nodes[0])
}
c.logf("%s: connecting websocket to %v", caller, urlStr)
conn, err := dialWebsocketFunc(ctx, urlStr)
conn, err := dialWebsocketFunc(ctx, urlStr, tlsConfig)
if err != nil {
c.logf("%s: websocket to %v error: %v", caller, urlStr, err)
return nil, 0, err
@ -363,7 +369,7 @@ func (c *Client) connect(ctx context.Context, caller string) (client *derp.Clien
var serverProtoVersion int
var tlsState *tls.ConnectionState
if c.useHTTPS() {
tlsConn := c.tlsClient(tcpConn, node)
tlsConn := tls.Client(tcpConn, c.tlsConfig(node))
httpConn = tlsConn
// Force a handshake now (instead of waiting for it to
@ -522,7 +528,7 @@ func (c *Client) dialRegion(ctx context.Context, reg *tailcfg.DERPRegion) (net.C
return nil, nil, firstErr
}
func (c *Client) tlsClient(nc net.Conn, node *tailcfg.DERPNode) *tls.Conn {
func (c *Client) tlsConfig(node *tailcfg.DERPNode) *tls.Config {
tlsConf := tlsdial.Config(c.tlsServerName(node), c.TLSConfig)
if node != nil {
if node.InsecureForTests {
@ -533,7 +539,7 @@ func (c *Client) tlsClient(nc net.Conn, node *tailcfg.DERPNode) *tls.Conn {
tlsdial.SetConfigExpectedCert(tlsConf, node.CertName)
}
}
return tls.Client(nc, tlsConf)
return tlsConf
}
// DialRegionTLS returns a TLS connection to a DERP node in the given region.
@ -549,7 +555,7 @@ func (c *Client) DialRegionTLS(ctx context.Context, reg *tailcfg.DERPRegion) (tl
done := make(chan bool) // unbuffered
defer close(done)
tlsConn = c.tlsClient(tcpConn, node)
tlsConn = tls.Client(tcpConn, c.tlsConfig(node))
go func() {
select {
case <-done:

11
derp/derphttp/websocket.go
View File

@ -1,14 +1,16 @@
// Copyright (c) Tailscale Inc & AUTHORS
// SPDX-License-Identifier: BSD-3-Clause
//go:build linux || js
//go:build linux || windows || darwin || js
package derphttp
import (
"context"
"crypto/tls"
"log"
"net"
"net/http"
"nhooyr.io/websocket"
"tailscale.com/net/wsconn"
@ -18,8 +20,13 @@ func init() {
dialWebsocketFunc = dialWebsocket
}
func dialWebsocket(ctx context.Context, urlStr string) (net.Conn, error) {
func dialWebsocket(ctx context.Context, urlStr string, tlsConfig *tls.Config) (net.Conn, error) {
c, res, err := websocket.Dial(ctx, urlStr, &websocket.DialOptions{
HTTPClient: &http.Client{
Transport: &http.Transport{
TLSClientConfig: tlsConfig,
},
},
Subprotocols: []string{"derp"},
})
if err != nil {