Improve DERP server

Author: nekohasekai

derp/derp_server.go

@@ -18,6 +18,7 @@ import (
 	"errors"
 	"expvar"
 	"fmt"
+	E "github.com/sagernet/sing/common/exceptions"
 	"io"
 	"log"
 	"math"
@@ -174,9 +175,10 @@ type Server struct {
 	// server if the clientKey is a known peer in the network, as specified by a
 	// running tailscaled's client's LocalAPI.
 	verifyClientsLocalTailscaled bool
-
-	verifyClientsURL         string
-	verifyClientsURLFailOpen bool
+	verifyClientLocalClient      []*tailscale.LocalClient
+	verifyClientHTTPClient       *http.Client
+	verifyClientsURL             []string
+	verifyClientsURLFailOpen     bool
 
 	mu       sync.Mutex
 	closed   bool
@@ -471,10 +473,18 @@ func (s *Server) SetVerifyClient(v bool) {
 	s.verifyClientsLocalTailscaled = v
 }
 
+func (s *Server) SetVerifyClientLocalClient(localClient []*tailscale.LocalClient) {
+	s.verifyClientLocalClient = localClient
+}
+
+func (s *Server) SetVerifyClientHTTPClient(httpClient *http.Client) {
+	s.verifyClientHTTPClient = httpClient
+}
+
 // SetVerifyClientURL sets the admission controller URL to use for verifying clients.
 // If empty, all clients are accepted (unless restricted by SetVerifyClient checking
 // against tailscaled).
-func (s *Server) SetVerifyClientURL(v string) {
+func (s *Server) SetVerifyClientURL(v []string) {
 	s.verifyClientsURL = v
 }
 
@@ -1352,42 +1362,72 @@ func (s *Server) verifyClient(ctx context.Context, clientKey key.NodePublic, inf
 		}
 	}
 
+	var errors []error
+	if len(s.verifyClientLocalClient) > 0 {
+		for _, verifyClient := range s.verifyClientLocalClient {
+			_, err := verifyClient.WhoIsNodeKey(ctx, clientKey)
+			if err == tailscale.ErrPeerNotFound {
+				errors = append(errors, fmt.Errorf("peer %v not authorized (not found in local tailscaled)", clientKey))
+				continue
+			}
+			if err != nil {
+				if strings.Contains(err.Error(), "invalid 'addr' parameter") {
+					// Issue 12617
+					errors = append(errors, E.New("tailscaled version is too old (out of sync with derper binary)"))
+					continue
+				}
+				errors = append(errors, fmt.Errorf("failed to query local tailscaled status for %v: %w", clientKey, err))
+				continue
+			}
+			return nil
+		}
+	}
 	// admission controller-based verification:
-	if s.verifyClientsURL != "" {
-		ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
-		defer cancel()
-
+	if len(s.verifyClientsURL) > 0 {
 		jreq, err := json.Marshal(&tailcfg.DERPAdmitClientRequest{
 			NodePublic: clientKey,
 			Source:     clientIP,
 		})
 		if err != nil {
 			return err
 		}
-		req, err := http.NewRequestWithContext(ctx, "POST", s.verifyClientsURL, bytes.NewReader(jreq))
-		if err != nil {
-			return err
-		}
-		res, err := http.DefaultClient.Do(req)
-		if err != nil {
-			if s.verifyClientsURLFailOpen {
-				s.logf("admission controller unreachable; allowing client %v", clientKey)
-				return nil
+
+		for _, verifyClientsURL := range s.verifyClientsURL {
+			ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+			defer cancel()
+			req, err := http.NewRequestWithContext(ctx, "POST", verifyClientsURL, bytes.NewReader(jreq))
+			if err != nil {
+				return err
 			}
-			return err
-		}
-		defer res.Body.Close()
-		if res.StatusCode != 200 {
-			return fmt.Errorf("admission controller: %v", res.Status)
-		}
-		var jres tailcfg.DERPAdmitClientResponse
-		if err := json.NewDecoder(io.LimitReader(res.Body, 4<<10)).Decode(&jres); err != nil {
-			return err
-		}
-		if !jres.Allow {
-			return fmt.Errorf("admission controller: %v/%v not allowed", clientKey, clientIP)
+			res, err := s.verifyClientHTTPClient.Do(req)
+			if err != nil {
+				if s.verifyClientsURLFailOpen {
+					s.logf("admission controller unreachable; allowing client %v", clientKey)
+					continue
+				}
+				errors = append(errors, err)
+				continue
+			}
+			defer res.Body.Close()
+			if res.StatusCode != 200 {
+				errors = append(errors, fmt.Errorf("admission controller: %v", res.Status))
+				continue
+			}
+			var jres tailcfg.DERPAdmitClientResponse
+			if err := json.NewDecoder(io.LimitReader(res.Body, 4<<10)).Decode(&jres); err != nil {
+				errors = append(errors, err)
+				continue
+			}
+			if !jres.Allow {
+				errors = append(errors, fmt.Errorf("admission controller: %v/%v not allowed", clientKey, clientIP))
+				continue
+			}
+			// TODO(bradfitz): add policy for configurable bandwidth rate per client?
+			return nil
 		}
-		// TODO(bradfitz): add policy for configurable bandwidth rate per client?
+	}
+	if len(errors) > 0 {
+		return E.Errors(errors...)
 	}
 	return nil
 }

derp/derphttp/derphttp_client.go

@@ -645,7 +645,12 @@ func (c *Client) dialRegion(ctx context.Context, reg *tailcfg.DERPRegion) (net.C
 }
 
 func (c *Client) tlsClient(nc net.Conn, node *tailcfg.DERPNode) *tls.Conn {
-	tlsConf := tlsdial.Config(c.tlsServerName(node), c.HealthTracker, c.TLSConfig)
+	var tlsConf *tls.Config
+	if c.TLSConfig != nil {
+		tlsConf = c.TLSConfig
+	} else {
+		tlsConf = tlsdial.Config(c.tlsServerName(node), c.HealthTracker, &tls.Config{})
+	}
 	if node != nil {
 		if node.InsecureForTests {
 			tlsConf.InsecureSkipVerify = true

go.sum

@@ -122,8 +122,6 @@ github.com/safchain/ethtool v0.3.0 h1:gimQJpsI6sc1yIqP/y8GYgiXn/NjgvpM0RNoWLVVmP
 github.com/safchain/ethtool v0.3.0/go.mod h1:SA9BwrgyAqNo7M+uaL6IYbxpm5wk3L7Mm6ocLW+CJUs=
 github.com/sagernet/gvisor v0.0.0-20241021032506-a4324256e4a3 h1:RxEz7LhPNiF/gX/Hg+OXr5lqsM9iVAgmaK1L1vzlDRM=
 github.com/sagernet/gvisor v0.0.0-20241021032506-a4324256e4a3/go.mod h1:ehZwnT2UpmOWAHFL48XdBhnd4Qu4hN2O3Ji0us3ZHMw=
-github.com/sagernet/sing v0.5.1 h1:mhL/MZVq0TjuvHcpYcFtmSD1BFOxZ/+8ofbNZcg1k1Y=
-github.com/sagernet/sing v0.5.1/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
 github.com/sagernet/sing v0.6.1 h1:mJ6e7Ir2wtCoGLbdnnXWBsNJu5YHtbXmv66inoE0zFA=
 github.com/sagernet/sing v0.6.1/go.mod h1:ARkL0gM13/Iv5VCZmci/NuoOlePoIsW0m7BWfln/Hak=
 github.com/sagernet/wireguard-go v0.0.1-beta.4 h1:8uyM5fxfEXdu4RH05uOK+v25i3lTNdCYMPSAUJ14FnI=

tsweb/debug.go

@@ -14,7 +14,6 @@ import (
 	"os"
 	"runtime"
 
-	"github.com/sagernet/tailscale/tsweb/promvarz"
 	"github.com/sagernet/tailscale/tsweb/varz"
 	"github.com/sagernet/tailscale/version"
 )
@@ -51,7 +50,6 @@ func Debugger(mux *http.ServeMux) *DebugHandler {
 	ret.KVFunc("Uptime", func() any { return varz.Uptime() })
 	ret.KV("Version", version.Long())
 	ret.Handle("vars", "Metrics (Go)", expvar.Handler())
-	ret.Handle("varz", "Metrics (Prometheus)", http.HandlerFunc(promvarz.Handler))
 
 	// pprof.Index serves everything that runtime/pprof.Lookup finds:
 	// goroutine, threadcreate, heap, allocs, block, mutex