Move Linux client & common packages into a public repo.

2020-02-05 14:16:58 -08:00
parent c955043dfe
commit a8d8b8719a
156 changed files with 17113 additions and 0 deletions
@@ -0,0 +1,203 @@
+// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package derphttp implements DERP-over-HTTP.
+//
+// This makes DERP look exactly like WebSockets.
+// A server can implement DERP over HTTPS and even if the TLS connection
+// intercepted using a fake root CA, unless the interceptor knows how to
+// detect DERP packets, it will look like a web socket.
+package derphttp
+
+import (
+	"bufio"
+	"bytes"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/url"
+	"sync"
+
+	"tailscale.com/derp"
+)
+
+// Client is a DERP-over-HTTP client.
+//
+// It automatically reconnects on error retry. That is, a failed Send or
+// Recv will report the error and not retry, but subsequent calls to
+// Send/Recv will completely re-establish the connection.
+type Client struct {
+	privateKey [32]byte
+	logf       func(format string, args ...interface{})
+	closed     chan struct{}
+	url        *url.URL
+	resp       *http.Response
+
+	netConnMu sync.Mutex
+	netConn   net.Conn
+
+	clientMu sync.Mutex
+	client   *derp.Client
+}
+
+func NewClient(privateKey [32]byte, serverURL string, logf func(format string, args ...interface{})) (c *Client, err error) {
+	u, err := url.Parse(serverURL)
+	if err != nil {
+		return nil, fmt.Errorf("derphttp.NewClient: %v", err)
+	}
+
+	c = &Client{
+		privateKey: privateKey,
+		logf:       logf,
+		url:        u,
+		closed:     make(chan struct{}),
+	}
+	if _, err := c.connect("derphttp.NewClient"); err != nil {
+		c.logf("%v", err)
+	}
+	return c, nil
+}
+
+func (c *Client) connect(caller string) (client *derp.Client, err error) {
+	select {
+	case <-c.closed:
+		return nil, ErrClientClosed
+	default:
+	}
+
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+
+	if c.client != nil {
+		return c.client, nil
+	}
+
+	c.logf("%s: connecting", caller)
+
+	var netConn net.Conn
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("%s connect: %v", caller, err)
+			if netConn := netConn; netConn != nil {
+				netConn.Close()
+			}
+		}
+	}()
+
+	if c.url.Scheme == "https" {
+		port := c.url.Port()
+		if port == "" {
+			port = "443"
+		}
+		config := &tls.Config{}
+		var tlsConn *tls.Conn
+		tlsConn, err = tls.Dial("tcp", net.JoinHostPort(c.url.Host, port), config)
+		if tlsConn != nil {
+			netConn = tlsConn
+		}
+	} else {
+		netConn, err = net.Dial("tcp", c.url.Host)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	c.netConnMu.Lock()
+	c.netConn = netConn
+	c.netConnMu.Unlock()
+
+	conn := bufio.NewReadWriter(bufio.NewReader(netConn), bufio.NewWriter(netConn))
+
+	req, err := http.NewRequest("GET", c.url.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Upgrade", "WebSocket")
+	req.Header.Set("Connection", "Upgrade")
+	if err := req.Write(conn); err != nil {
+		return nil, err
+	}
+	if err := conn.Flush(); err != nil {
+		return nil, err
+	}
+
+	resp, err := http.ReadResponse(conn.Reader, req)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusSwitchingProtocols {
+		b, _ := ioutil.ReadAll(resp.Body)
+		resp.Body.Close()
+		return nil, fmt.Errorf("GET failed: %v: %s", err, b)
+	}
+	resp.Body = ioutil.NopCloser(bytes.NewReader([]byte{}))
+
+	derpClient, err := derp.NewClient(c.privateKey, netConn, conn, c.logf)
+	if err != nil {
+		return nil, err
+	}
+	c.resp = resp
+	c.client = derpClient
+	return c.client, nil
+}
+
+func (c *Client) Send(dstKey [32]byte, b []byte) error {
+	client, err := c.connect("derphttp.Client.Send")
+	if err != nil {
+		return err
+	}
+	if err := client.Send(dstKey, b); err != nil {
+		c.close()
+	}
+	return err
+}
+
+func (c *Client) Recv(b []byte) (int, error) {
+	client, err := c.connect("derphttp.Client.Recv")
+	if err != nil {
+		return 0, err
+	}
+	n, err := client.Recv(b)
+	if err != nil {
+		c.close()
+	}
+	return n, err
+}
+
+func (c *Client) Close() error {
+	select {
+	case <-c.closed:
+		return ErrClientClosed
+	default:
+	}
+	close(c.closed)
+	c.close()
+	return nil
+}
+
+func (c *Client) close() {
+	c.netConnMu.Lock()
+	netConn := c.netConn
+	c.netConnMu.Unlock()
+
+	if netConn != nil {
+		netConn.Close()
+	}
+
+	c.clientMu.Lock()
+	defer c.clientMu.Unlock()
+	if c.client == nil {
+		return
+	}
+	c.resp = nil
+	c.client = nil
+	c.netConnMu.Lock()
+	c.netConn = nil
+	c.netConnMu.Unlock()
+}
+
+var ErrClientClosed = errors.New("derphttp.Client closed")
@@ -0,0 +1,35 @@
+// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package derphttp
+
+import (
+	"net/http"
+
+	"tailscale.com/derp"
+)
+
+func Handler(s *derp.Server) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Upgrade") != "WebSocket" {
+			http.Error(w, "DERP requires connection upgrade", http.StatusUpgradeRequired)
+			return
+		}
+		w.Header().Set("Upgrade", "WebSocket")
+		w.Header().Set("Connection", "Upgrade")
+		w.WriteHeader(http.StatusSwitchingProtocols)
+
+		h, ok := w.(http.Hijacker)
+		if !ok {
+			http.Error(w, "HTTP does not support general TCP support", 500)
+			return
+		}
+		netConn, conn, err := h.Hijack()
+		if err != nil {
+			http.Error(w, "HTTP does not support general TCP support", 500)
+			return
+		}
+		s.Accept(netConn, conn)
+	})
+}
@@ -0,0 +1,142 @@
+// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package derphttp
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/curve25519"
+	"tailscale.com/derp"
+)
+
+func TestSendRecv(t *testing.T) {
+	const numClients = 3
+	var serverPrivateKey [32]byte
+	if _, err := rand.Read(serverPrivateKey[:]); err != nil {
+		t.Fatal(err)
+	}
+	var clientPrivateKeys [][32]byte
+	for i := 0; i < numClients; i++ {
+		var key [32]byte
+		if _, err := rand.Read(key[:]); err != nil {
+			t.Fatal(err)
+		}
+		clientPrivateKeys = append(clientPrivateKeys, key)
+	}
+	var clientKeys [][32]byte
+	for _, privKey := range clientPrivateKeys {
+		var key [32]byte
+		curve25519.ScalarBaseMult(&key, &privKey)
+		clientKeys = append(clientKeys, key)
+	}
+
+	s := derp.NewServer(serverPrivateKey, t.Logf)
+	defer s.Close()
+
+	httpsrv := &http.Server{
+		TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
+		Handler:      Handler(s),
+	}
+
+	ln, err := net.Listen("tcp4", "localhost:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	serverURL := "http://" + ln.Addr().String()
+	t.Logf("server URL: %s", serverURL)
+
+	go func() {
+		if err := httpsrv.Serve(ln); err != nil {
+			if err == http.ErrServerClosed {
+				return
+			}
+			panic(err)
+		}
+	}()
+
+	var clients []*Client
+	var recvChs []chan []byte
+	done := make(chan struct{})
+	var wg sync.WaitGroup
+	defer func() {
+		close(done)
+		for _, c := range clients {
+			c.Close()
+		}
+		wg.Wait()
+	}()
+	for i := 0; i < numClients; i++ {
+		key := clientPrivateKeys[i]
+		c, err := NewClient(key, serverURL, t.Logf)
+		if err != nil {
+			t.Fatalf("client %d: %v", i, err)
+		}
+		clients = append(clients, c)
+		recvChs = append(recvChs, make(chan []byte))
+
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			for {
+				select {
+				case <-done:
+					return
+				default:
+				}
+				b := make([]byte, 1<<16)
+				n, err := c.Recv(b)
+				if err != nil {
+					t.Logf("client%d: %v", i, err)
+					break
+				}
+				b = b[:n]
+				recvChs[i] <- b
+			}
+		}(i)
+	}
+
+	recv := func(i int, want string) {
+		t.Helper()
+		select {
+		case b := <-recvChs[i]:
+			if got := string(b); got != want {
+				t.Errorf("client1.Recv=%q, want %q", got, want)
+			}
+		case <-time.After(1 * time.Second):
+			t.Errorf("client%d.Recv, got nothing, want %q", i, want)
+		}
+	}
+	recvNothing := func(i int) {
+		t.Helper()
+		select {
+		case b := <-recvChs[0]:
+			t.Errorf("client%d.Recv=%q, want nothing", i, string(b))
+		default:
+		}
+	}
+
+	msg1 := []byte("hello 0->1\n")
+	if err := clients[0].Send(clientKeys[1], msg1); err != nil {
+		t.Fatal(err)
+	}
+	recv(1, string(msg1))
+	recvNothing(0)
+	recvNothing(2)
+
+	msg2 := []byte("hello 1->2\n")
+	if err := clients[1].Send(clientKeys[2], msg2); err != nil {
+		t.Fatal(err)
+	}
+	recv(2, string(msg2))
+	recvNothing(0)
+	recvNothing(1)
+
+}