2020-06-21 04:32:08 -06:00
|
|
|
// Codehere is mostly taken from github.com/tailscale/tailscale
|
|
|
|
// Copyright (c) 2020 Tailscale Inc & AUTHORS All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package headscale
|
|
|
|
|
|
|
|
import (
|
2021-10-30 08:29:03 -06:00
|
|
|
"context"
|
2022-01-25 15:11:15 -07:00
|
|
|
"crypto/rand"
|
|
|
|
"encoding/base64"
|
2020-06-21 04:32:08 -06:00
|
|
|
"encoding/json"
|
|
|
|
"fmt"
|
2021-10-30 08:29:03 -06:00
|
|
|
"net"
|
2022-04-25 13:50:40 -06:00
|
|
|
"reflect"
|
2021-08-13 03:33:19 -06:00
|
|
|
"strings"
|
2020-06-21 04:32:08 -06:00
|
|
|
|
2021-11-26 16:30:42 -07:00
|
|
|
"github.com/rs/zerolog/log"
|
2021-08-02 13:06:26 -06:00
|
|
|
"inet.af/netaddr"
|
2021-08-13 03:33:19 -06:00
|
|
|
"tailscale.com/tailcfg"
|
2021-11-26 16:30:42 -07:00
|
|
|
"tailscale.com/types/key"
|
2020-06-21 04:32:08 -06:00
|
|
|
)
|
|
|
|
|
2021-11-15 12:18:14 -07:00
|
|
|
const (
|
|
|
|
errCannotDecryptReponse = Error("cannot decrypt response")
|
|
|
|
errCouldNotAllocateIP = Error("could not find any suitable IP")
|
2021-11-26 16:30:42 -07:00
|
|
|
|
|
|
|
// These constants are copied from the upstream tailscale.com/types/key
|
|
|
|
// library, because they are not exported.
|
|
|
|
// https://github.com/tailscale/tailscale/tree/main/types/key
|
|
|
|
|
|
|
|
// nodePublicHexPrefix is the prefix used to identify a
|
|
|
|
// hex-encoded node public key.
|
|
|
|
//
|
|
|
|
// This prefix is used in the control protocol, so cannot be
|
|
|
|
// changed.
|
|
|
|
nodePublicHexPrefix = "nodekey:"
|
|
|
|
|
|
|
|
// machinePublicHexPrefix is the prefix used to identify a
|
|
|
|
// hex-encoded machine public key.
|
|
|
|
//
|
|
|
|
// This prefix is used in the control protocol, so cannot be
|
|
|
|
// changed.
|
|
|
|
machinePublicHexPrefix = "mkey:"
|
|
|
|
|
|
|
|
// discoPublicHexPrefix is the prefix used to identify a
|
|
|
|
// hex-encoded disco public key.
|
|
|
|
//
|
|
|
|
// This prefix is used in the control protocol, so cannot be
|
|
|
|
// changed.
|
|
|
|
discoPublicHexPrefix = "discokey:"
|
2021-11-28 02:17:18 -07:00
|
|
|
|
|
|
|
// privateKey prefix.
|
|
|
|
privateHexPrefix = "privkey:"
|
2021-11-15 12:18:14 -07:00
|
|
|
)
|
|
|
|
|
2021-11-26 16:30:42 -07:00
|
|
|
func MachinePublicKeyStripPrefix(machineKey key.MachinePublic) string {
|
|
|
|
return strings.TrimPrefix(machineKey.String(), machinePublicHexPrefix)
|
|
|
|
}
|
|
|
|
|
|
|
|
func NodePublicKeyStripPrefix(nodeKey key.NodePublic) string {
|
|
|
|
return strings.TrimPrefix(nodeKey.String(), nodePublicHexPrefix)
|
|
|
|
}
|
|
|
|
|
|
|
|
func DiscoPublicKeyStripPrefix(discoKey key.DiscoPublic) string {
|
|
|
|
return strings.TrimPrefix(discoKey.String(), discoPublicHexPrefix)
|
|
|
|
}
|
|
|
|
|
2021-11-27 13:25:12 -07:00
|
|
|
func MachinePublicKeyEnsurePrefix(machineKey string) string {
|
|
|
|
if !strings.HasPrefix(machineKey, machinePublicHexPrefix) {
|
|
|
|
return machinePublicHexPrefix + machineKey
|
|
|
|
}
|
|
|
|
|
|
|
|
return machineKey
|
|
|
|
}
|
|
|
|
|
|
|
|
func NodePublicKeyEnsurePrefix(nodeKey string) string {
|
|
|
|
if !strings.HasPrefix(nodeKey, nodePublicHexPrefix) {
|
|
|
|
return nodePublicHexPrefix + nodeKey
|
|
|
|
}
|
|
|
|
|
|
|
|
return nodeKey
|
|
|
|
}
|
|
|
|
|
|
|
|
func DiscoPublicKeyEnsurePrefix(discoKey string) string {
|
|
|
|
if !strings.HasPrefix(discoKey, discoPublicHexPrefix) {
|
|
|
|
return discoPublicHexPrefix + discoKey
|
|
|
|
}
|
|
|
|
|
|
|
|
return discoKey
|
|
|
|
}
|
|
|
|
|
2021-11-28 02:17:18 -07:00
|
|
|
func PrivateKeyEnsurePrefix(privateKey string) string {
|
|
|
|
if !strings.HasPrefix(privateKey, privateHexPrefix) {
|
|
|
|
return privateHexPrefix + privateKey
|
|
|
|
}
|
|
|
|
|
|
|
|
return privateKey
|
|
|
|
}
|
|
|
|
|
2021-05-05 17:01:45 -06:00
|
|
|
// Error is used to compare errors as per https://dave.cheney.net/2016/04/07/constant-errors
|
2021-05-05 15:00:04 -06:00
|
|
|
type Error string
|
|
|
|
|
|
|
|
func (e Error) Error() string { return string(e) }
|
|
|
|
|
2021-11-13 01:36:45 -07:00
|
|
|
func decode(
|
|
|
|
msg []byte,
|
2021-11-14 12:32:03 -07:00
|
|
|
output interface{},
|
2021-11-26 16:30:42 -07:00
|
|
|
pubKey *key.MachinePublic,
|
|
|
|
privKey *key.MachinePrivate,
|
2021-11-13 01:36:45 -07:00
|
|
|
) error {
|
2021-11-26 16:30:42 -07:00
|
|
|
log.Trace().Int("length", len(msg)).Msg("Trying to decrypt")
|
|
|
|
|
|
|
|
decrypted, ok := privKey.OpenFrom(*pubKey, msg)
|
|
|
|
if !ok {
|
|
|
|
return errCannotDecryptReponse
|
2020-06-21 04:32:08 -06:00
|
|
|
}
|
2021-11-26 16:30:42 -07:00
|
|
|
|
2021-11-14 12:32:03 -07:00
|
|
|
if err := json.Unmarshal(decrypted, output); err != nil {
|
2021-11-15 12:18:14 -07:00
|
|
|
return err
|
2020-06-21 04:32:08 -06:00
|
|
|
}
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2020-06-21 04:32:08 -06:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-11-26 16:30:42 -07:00
|
|
|
func encode(
|
|
|
|
v interface{},
|
|
|
|
pubKey *key.MachinePublic,
|
|
|
|
privKey *key.MachinePrivate,
|
|
|
|
) ([]byte, error) {
|
2020-06-21 04:32:08 -06:00
|
|
|
b, err := json.Marshal(v)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-08-13 03:33:19 -06:00
|
|
|
|
2021-11-26 16:30:42 -07:00
|
|
|
return privKey.SealTo(*pubKey, b), nil
|
2020-06-21 04:32:08 -06:00
|
|
|
}
|
|
|
|
|
2022-05-16 06:59:46 -06:00
|
|
|
func (h *Headscale) getAvailableIPs() (MachineAddresses, error) {
|
|
|
|
var ips MachineAddresses
|
|
|
|
var err error
|
2022-01-16 06:16:59 -07:00
|
|
|
ipPrefixes := h.cfg.IPPrefixes
|
|
|
|
for _, ipPrefix := range ipPrefixes {
|
|
|
|
var ip *netaddr.IP
|
|
|
|
ip, err = h.getAvailableIP(ipPrefix)
|
|
|
|
if err != nil {
|
2022-05-16 06:59:46 -06:00
|
|
|
return ips, err
|
2022-01-16 06:16:59 -07:00
|
|
|
}
|
|
|
|
ips = append(ips, *ip)
|
|
|
|
}
|
2021-08-02 14:57:45 -06:00
|
|
|
|
2022-05-16 06:59:46 -06:00
|
|
|
return ips, err
|
2022-01-16 06:16:59 -07:00
|
|
|
}
|
|
|
|
|
2022-05-16 06:59:46 -06:00
|
|
|
func GetIPPrefixEndpoints(na netaddr.IPPrefix) (netaddr.IP, netaddr.IP) {
|
|
|
|
var network, broadcast netaddr.IP
|
2022-01-29 07:26:28 -07:00
|
|
|
ipRange := na.Range()
|
|
|
|
network = ipRange.From()
|
|
|
|
broadcast = ipRange.To()
|
2022-01-30 01:35:10 -07:00
|
|
|
|
2022-05-16 06:59:46 -06:00
|
|
|
return network, broadcast
|
2022-01-29 07:26:28 -07:00
|
|
|
}
|
|
|
|
|
2022-01-16 06:16:59 -07:00
|
|
|
func (h *Headscale) getAvailableIP(ipPrefix netaddr.IPPrefix) (*netaddr.IP, error) {
|
2021-08-02 14:57:45 -06:00
|
|
|
usedIps, err := h.getUsedIPs()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-01-29 07:26:28 -07:00
|
|
|
ipPrefixNetworkAddress, ipPrefixBroadcastAddress := GetIPPrefixEndpoints(ipPrefix)
|
2021-10-31 09:05:08 -06:00
|
|
|
|
2021-08-02 14:57:45 -06:00
|
|
|
// Get the first IP in our prefix
|
2021-10-31 09:05:08 -06:00
|
|
|
ip := ipPrefixNetworkAddress.Next()
|
2021-08-02 14:57:45 -06:00
|
|
|
|
2020-06-21 04:32:08 -06:00
|
|
|
for {
|
2021-08-02 14:57:45 -06:00
|
|
|
if !ipPrefix.Contains(ip) {
|
2021-11-15 12:18:14 -07:00
|
|
|
return nil, errCouldNotAllocateIP
|
2020-06-21 04:32:08 -06:00
|
|
|
}
|
2021-08-02 14:57:45 -06:00
|
|
|
|
2021-10-31 09:05:08 -06:00
|
|
|
switch {
|
|
|
|
case ip.Compare(ipPrefixBroadcastAddress) == 0:
|
|
|
|
fallthrough
|
2022-02-24 06:18:18 -07:00
|
|
|
case usedIps.Contains(ip):
|
2021-10-31 09:05:08 -06:00
|
|
|
fallthrough
|
|
|
|
case ip.IsZero() || ip.IsLoopback():
|
2021-08-03 03:06:42 -06:00
|
|
|
ip = ip.Next()
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-08-02 14:57:45 -06:00
|
|
|
continue
|
|
|
|
|
2021-10-31 09:05:08 -06:00
|
|
|
default:
|
2021-08-02 14:57:45 -06:00
|
|
|
return &ip, nil
|
2020-06-21 04:32:08 -06:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-25 01:28:22 -07:00
|
|
|
func (h *Headscale) getUsedIPs() (*netaddr.IPSet, error) {
|
2022-01-16 06:16:59 -07:00
|
|
|
// FIXME: This really deserves a better data model,
|
|
|
|
// but this was quick to get running and it should be enough
|
|
|
|
// to begin experimenting with a dual stack tailnet.
|
|
|
|
var addressesSlices []string
|
|
|
|
h.db.Model(&Machine{}).Pluck("ip_addresses", &addressesSlices)
|
|
|
|
|
2022-02-24 06:18:18 -07:00
|
|
|
var ips netaddr.IPSetBuilder
|
2022-01-16 06:16:59 -07:00
|
|
|
for _, slice := range addressesSlices {
|
2022-02-24 06:18:18 -07:00
|
|
|
var machineAddresses MachineAddresses
|
|
|
|
err := machineAddresses.Scan(slice)
|
2022-01-16 06:16:59 -07:00
|
|
|
if err != nil {
|
2022-02-25 01:28:22 -07:00
|
|
|
return &netaddr.IPSet{}, fmt.Errorf(
|
2022-02-24 06:18:18 -07:00
|
|
|
"failed to read ip from database: %w",
|
|
|
|
err,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, ip := range machineAddresses {
|
|
|
|
ips.Add(ip)
|
2021-08-03 00:42:11 -06:00
|
|
|
}
|
2021-08-02 14:57:45 -06:00
|
|
|
}
|
|
|
|
|
2022-02-25 01:28:22 -07:00
|
|
|
ipSet, err := ips.IPSet()
|
|
|
|
if err != nil {
|
|
|
|
return &netaddr.IPSet{}, fmt.Errorf(
|
|
|
|
"failed to build IP Set: %w",
|
|
|
|
err,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
return ipSet, nil
|
2021-08-02 14:57:45 -06:00
|
|
|
}
|
|
|
|
|
2021-08-13 03:33:19 -06:00
|
|
|
func tailNodesToString(nodes []*tailcfg.Node) string {
|
|
|
|
temp := make([]string, len(nodes))
|
|
|
|
|
|
|
|
for index, node := range nodes {
|
|
|
|
temp[index] = node.Name
|
|
|
|
}
|
|
|
|
|
|
|
|
return fmt.Sprintf("[ %s ](%d)", strings.Join(temp, ", "), len(temp))
|
|
|
|
}
|
|
|
|
|
|
|
|
func tailMapResponseToString(resp tailcfg.MapResponse) string {
|
2021-11-13 01:36:45 -07:00
|
|
|
return fmt.Sprintf(
|
|
|
|
"{ Node: %s, Peers: %s }",
|
|
|
|
resp.Node.Name,
|
|
|
|
tailNodesToString(resp.Peers),
|
|
|
|
)
|
2021-08-13 03:33:19 -06:00
|
|
|
}
|
2021-10-30 08:29:03 -06:00
|
|
|
|
|
|
|
func GrpcSocketDialer(ctx context.Context, addr string) (net.Conn, error) {
|
|
|
|
var d net.Dialer
|
2021-11-14 08:46:09 -07:00
|
|
|
|
2021-10-30 08:29:03 -06:00
|
|
|
return d.DialContext(ctx, "unix", addr)
|
|
|
|
}
|
2021-11-04 16:17:44 -06:00
|
|
|
|
|
|
|
func ipPrefixToString(prefixes []netaddr.IPPrefix) []string {
|
|
|
|
result := make([]string, len(prefixes))
|
|
|
|
|
|
|
|
for index, prefix := range prefixes {
|
|
|
|
result[index] = prefix.String()
|
|
|
|
}
|
|
|
|
|
|
|
|
return result
|
|
|
|
}
|
|
|
|
|
2021-11-15 10:24:24 -07:00
|
|
|
func stringToIPPrefix(prefixes []string) ([]netaddr.IPPrefix, error) {
|
2021-11-04 16:17:44 -06:00
|
|
|
result := make([]netaddr.IPPrefix, len(prefixes))
|
|
|
|
|
|
|
|
for index, prefixStr := range prefixes {
|
|
|
|
prefix, err := netaddr.ParseIPPrefix(prefixStr)
|
|
|
|
if err != nil {
|
|
|
|
return []netaddr.IPPrefix{}, err
|
|
|
|
}
|
|
|
|
|
|
|
|
result[index] = prefix
|
|
|
|
}
|
|
|
|
|
|
|
|
return result, nil
|
|
|
|
}
|
|
|
|
|
2022-04-25 13:50:40 -06:00
|
|
|
func contains[T string | netaddr.IPPrefix](ts []T, t T) bool {
|
|
|
|
for _, v := range ts {
|
|
|
|
if reflect.DeepEqual(v, t) {
|
2021-11-04 16:17:44 -06:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
2022-01-25 15:11:15 -07:00
|
|
|
|
|
|
|
// GenerateRandomBytes returns securely generated random bytes.
|
|
|
|
// It will return an error if the system's secure random
|
|
|
|
// number generator fails to function correctly, in which
|
|
|
|
// case the caller should not continue.
|
|
|
|
func GenerateRandomBytes(n int) ([]byte, error) {
|
2022-02-12 12:42:55 -07:00
|
|
|
bytes := make([]byte, n)
|
|
|
|
|
2022-01-25 15:11:15 -07:00
|
|
|
// Note that err == nil only if we read len(b) bytes.
|
2022-02-12 12:42:55 -07:00
|
|
|
if _, err := rand.Read(bytes); err != nil {
|
2022-01-25 15:11:15 -07:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-02-12 12:42:55 -07:00
|
|
|
return bytes, nil
|
2022-01-25 15:11:15 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
// GenerateRandomStringURLSafe returns a URL-safe, base64 encoded
|
|
|
|
// securely generated random string.
|
|
|
|
// It will return an error if the system's secure random
|
|
|
|
// number generator fails to function correctly, in which
|
|
|
|
// case the caller should not continue.
|
|
|
|
func GenerateRandomStringURLSafe(n int) (string, error) {
|
|
|
|
b, err := GenerateRandomBytes(n)
|
2022-02-12 12:42:55 -07:00
|
|
|
|
2022-01-25 15:11:15 -07:00
|
|
|
return base64.RawURLEncoding.EncodeToString(b), err
|
|
|
|
}
|
2022-05-16 12:30:43 -06:00
|
|
|
|
|
|
|
// GenerateRandomStringDNSSafe returns a DNS-safe
|
|
|
|
// securely generated random string.
|
|
|
|
// It will return an error if the system's secure random
|
|
|
|
// number generator fails to function correctly, in which
|
|
|
|
// case the caller should not continue.
|
|
|
|
func GenerateRandomStringDNSSafe(n int) (string, error) {
|
|
|
|
str, err := GenerateRandomStringURLSafe(n)
|
|
|
|
|
|
|
|
str = strings.ReplaceAll(str, "_", "-")
|
|
|
|
|
|
|
|
return str[:n], err
|
|
|
|
}
|
2022-05-16 13:41:46 -06:00
|
|
|
|
2022-04-25 13:05:37 -06:00
|
|
|
func IsStringInSlice(slice []string, str string) bool {
|
|
|
|
for _, s := range slice {
|
|
|
|
if s == str {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|